MENU
After a recent malware incident, the forensic investigator is gathering details to identify the breach and causes. The investigator has isolated the affected workstation. What is the next step that should be taken in this investigation?
Suggested Answer: C
Get Premium 350-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
10 comments · newest first
KI
King
11 months ago
I disagree, the applications are where the malware usually hides.
MY
My
12 months ago
Gaps in configuration can lead to breaches, so that’s important too.
TO
Tonette
12 months ago
Surprised no one mentioned inspecting registry entries!
OL
Olen
1 year ago
I think checking the audit logs is more critical.
PO
Polly
1 year ago
Definitely should analyze the applications first.
AN
Angella
1 year ago
Comparing the workstation configuration to the asset policy could help identify gaps, but I wonder if we should focus more on immediate evidence first.
LA
Laine
1 year ago
Reviewing audit logs for privilege escalation events sounds relevant, but I feel like we should first look at the applications. It's hard to decide.
RO
Roosevelt
1 year ago
I'm not entirely sure, but I remember something about checking registry entries for recently executed files being important in similar practice questions.
KA
Karima
1 year ago
I think the next step might be to analyze the applications and services running on the workstation. That seems like a logical way to start identifying what went wrong.
TO
Tori
1 year ago
Hmm, I'm a bit unsure about this one. I'm not sure if the compatibility of virus scanners or the organization's firewall are really relevant when evaluating the cloud provider's security. I'll have to think this through carefully.