350-201 Question 210
Select 4A cybersecurity analyst receives an alert about suspicious activity on an employee's laptop. Upon investigation, the analyst notices unusual outbound network traffic, unauthorized software installations, and a significant increase in CPU usage. What steps should the analyst take to investigate this potential endpoint intrusion across the affected device?
- A
Isolate the laptop from the network to prevent further potential compromise.
- B
Run a full system scan using endpoint protection software to identify malware or other threats.
- C
Review the system logs and network traffic to identify the source and scope of the intrusion.
- D
Immediately delete the suspected malware files to stop any ongoing malicious activity.
- E
Verify the integrity of critical system files and applications for unauthorized modifications.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Proper investigation of a potential endpoint intrusion involves systematically isolating the affected device, scanning for threats, analyzing logs, and verifying system integrity. These steps ensure a comprehensive understanding of the extent of the intrusion and prevent further damage. However, deleting suspected malware files prematurely could hinder forensic analysis and recovery efforts.
- A. Correct.
Isolating the laptop from the network is a critical first step to prevent the potential spread of the threat to other devices or systems.
- B. Correct.
Running a full system scan helps identify known malware, viruses, or other malicious software that may be causing the suspicious activity.
- C. Correct.
Reviewing system logs and network traffic can help trace the origin of the intrusion and determine if other systems may be affected.
- D. Incorrect.
Deleting suspected malware files immediately without proper analysis could destroy evidence and prevent a thorough investigation of the attack vector.
- E. Correct.
Verifying the integrity of system files and applications helps identify unauthorized modifications that could indicate a compromise.