200-201 Question 78
Single answerA security analyst receives a report from a user who claims their workstation is running slower than usual and displaying multiple pop-up advertisements, even when no browser is open. Upon initial investigation, the analyst identifies unusual outbound connections from the workstation. What should the analyst do next to effectively interact with the user and address the issue?
- A
Instruct the user to immediately disconnect their workstation from the network and await further instructions.
- B
Ask the user to describe all recent activities on the workstation to identify potential sources of the issue.
- C
Reassure the user that the issue is minor and can be ignored while continuing to monitor the workstation remotely.
- D
Request that the user attempt to close the pop-ups and restart their workstation to resolve the issue.
Show answer and explanation
Correct answer: B
Explanation
Effective user interaction in cybersecurity operations involves clear communication and gathering relevant details to make informed decisions. Asking the user to describe their recent activities provides valuable context while maintaining user engagement, which is crucial for a thorough investigation. This step aligns with best practices in incident response and user interaction.
- A. Incorrect.
While disconnecting from the network is a valid containment step, instructing the user to do so immediately without gathering more information may disrupt the investigation process and miss critical details.
- B. Correct.
Asking the user to describe their recent activities helps the analyst identify potentially malicious actions (e.g., clicking on phishing links or downloading suspicious files) and is a critical step in user interaction during incident investigation.
- C. Incorrect.
Minimizing the user's concerns and suggesting the issue is minor could lead to the user ignoring or underreporting similar issues in the future, and it demonstrates poor interaction and communication skills.
- D. Incorrect.
Requesting the user to close pop-ups and restart the workstation might aggravate the issue or destroy valuable evidence of the compromise, making this an improper response.