Câu 20: 300-215: Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

1. A. Restore to a system recovery point.
2. B. Replace the faulty CPU.
3. C. Disconnect from the network. — đáp án hiện tại
4. D. Format the workstation drives.
5. E. Take an image of the workstation. — đáp án hiện tại