CS0-003 Question 132

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  The analyst has already contained the infected workstation. The next priority is to determine whether other employees received the same malicious attachment so the attack doesn't spread further.

• Chose C1

  Going with C myself, I agree with searching for others that recieved the e-mail, but not at the expense of any temporary files on the infected computer.

• Chose C2

  C. Acquire a bit-level image of the affected workstation. THIS STEP SHOULD BE AFTER CONTAINED THE ORIGINAL INFECTED MACHINE