100-160 Question 116
Select 3A cybersecurity technician discovers a suspicious process running on a Windows host. They decide to investigate further using built-in tools. Which combination of actions would help identify and potentially mitigate the threat?
- A
Use Task Manager to identify the process and its associated application.
- B
Enable the Windows Defender firewall to block all incoming connections.
- C
Check the file and directory permissions of the process executable using the CLI.
- D
Terminate the process immediately using PowerShell.
- E
Scan the system with Windows Defender to detect potential malware.
Show answer and explanation
Correct answers: A, C, E
Explanation
To investigate and mitigate a suspicious process, it is important to gather as much information as possible using tools like Task Manager, analyze permissions to check for anomalies, and scan the system for malware. These steps ensure thorough investigation and proper mitigation without compromising evidence or addressing the root cause.
- A. Correct.
Task Manager is a useful tool to identify suspicious processes and their associated applications, helping to gather more information about the issue.
- B. Incorrect.
Simply enabling the Windows Defender firewall to block all incoming connections is too broad and will not help specifically target the suspicious process.
- C. Correct.
Checking the file and directory permissions of the executable can reveal if improper permissions were set, which might have contributed to the security incident.
- D. Incorrect.
Terminating the process immediately without proper investigation can lead to loss of evidence and may not mitigate the root cause of the threat.
- E. Correct.
Scanning the system with Windows Defender can help identify and remove malware that may be associated with the suspicious process.