CiscoCisco
200-201 · Question #174
200-201 Question #174: Real Exam Question with Answer & Explanation
Sign in or unlock 200-201 to reveal the answer and full explanation for question #174. The question stem and answer options stay visible for context.
Submitted by the_admin· Mar 6, 2026Security Policies and Procedures
Question
An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day, an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation?
Options
- ARecovery
- BDetection
- CEradication
- DAnalysis
Unlock 200-201 to see the answer
You've previewed enough free 200-201 questions. Unlock 200-201 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#incident response#NIST framework#incident detection