200-201 Question 305
Single answerA security analyst is investigating suspicious activity on a workstation and notices an unknown process running in the background. The process is attempting to modify a critical registry key often associated with boot configurations. What is the BEST course of action for the analyst to take?
- A
Terminate the process immediately and delete the associated file.
- B
Isolate the affected workstation from the network and investigate further.
- C
Allow the process to continue running to gather more information.
- D
Ignore the activity, as it could be a false positive.
Show answer and explanation
Correct answer: B
Explanation
When encountering suspicious activity, the priority is to contain the threat while preserving evidence for analysis. Isolating the affected workstation from the network minimizes the risk of lateral movement or exfiltration while allowing the analyst to investigate the process and registry changes in a controlled environment. Jumping to termination or ignoring the issue could result in loss of critical information or escalation of the attack.
- A. Incorrect.
Immediately terminating the process and deleting the associated file could result in losing important forensic evidence, making it harder to fully investigate the incident.
- B. Correct.
Isolating the workstation ensures that the potentially malicious activity does not spread to other systems in the network. It also allows for further analysis of the process and registry modification attempts without risking additional damage.
- C. Incorrect.
Allowing the process to continue running without first containing the system could lead to further compromise or spread of malicious activity across the network.
- D. Incorrect.
Ignoring the activity is not a recommended action in a cybersecurity investigation, as it could lead to escalation of the threat or data loss.