Câu 61: 350-201: Performing CyberOps Using Core Security Technologies (CBRCOR)

A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user's laptop while traveling. The attacker has the user's credentials and is attempting to connect to the network. What is the next step in handling the incident?

1. A. Block the source IP from the firewall
2. B. Perform an antivirus scan on the laptop
3. C. Identify systems or services at risk — đáp án hiện tại
4. D. Identify lateral movement