PSOE Question 2

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  In incident response, the primary objective upon discovering an active server compromise is containment. You must isolate the asset immediately to stop lateral movement and network scanning while preserving volatile system memory and forensic data for investigation.

• Chose C2

  EDR integration is correct for isolation