Topics / Information Technology
During a workshop assessment, the reported condition is: An endpoint shows active malware behavior and is communicating with an unknown external host. What should happen first under the incident plan?
Answers
Aemail the suspected malware to every user
Berase all logs before analysis
Ccontain or isolate the endpoint while preserving evidence and escalating response
Dleave it connected to observe indefinitely
The answer and explanation are in the full bank.
This question is one of 2,831 in the paid banks. Each comes with the correct answer and the reasoning behind it, not just a mark.
Unlock for 5,000 RWFMIFOTRA exam practicealigned to CompTIA Core Skills·3 marks·Medium
More Information Technology questions
- A user complains that a file saved on their desktop is not accessible on their laptop. Which Microsoft 365 service should be configured to sync local folders?
- A new employee logs into the portal but sees a message that they do not have access to Word or Excel online. What is the administrative fix?
- Two users co-author a Word document offline. When they reconnect, OneDrive reports a sync conflict. How does OneDrive typically handle this?
- Which Microsoft 365 application is primarily used for persistent chat, video meetings, and collaborative workspaces?
- An admin needs to prevent users from forwarding sensitive emails outside the organization. Which M365 feature handles these restrictions?
- A user deleted an important email 10 days ago and emptied their Deleted Items folder. Where can the admin recover this item?
- Before applying a risky patch to a virtual server, an admin captures the exact state and data of the VM. What is this feature called?
- A virtualization host needs hardware maintenance during business hours. How can the admin migrate the running VMs to another host without downtime?