Câu 67: 350-201: Performing CyberOps Using Core Security Technologies (CBRCOR)

After a recent malware incident, the forensic investigator is gathering details to identify the breach and causes. The investigator has isolated the affected workstation. What is the next step that should be taken in this investigation?

1. A. Analyze the applications and services running on the affected workstation. — đáp án hiện tại
2. B. Compare workstation configuration and asset configuration policy to identify gaps.
3. C. Inspect registry entries for recently executed files.
4. D. Review audit logs for privilege escalation events.