Refer to the exhibit. A company employee receives an email from a customer. The email includes a Microsoft Word attachment. The moment the employee opens the attachment, the workstation begins to…

Question

Exhibit

Options

• Aif Patient 0 still demonstrates suspicious behavior
• Bsource code of the malicious attachment
• Cif the file in Patient 0 is encrypted
• Dif Patient 0 tried to connect to another workstation

• A
  5% (1)
• B
  5% (1)
• C
  10% (2)
• D
  80% (16)

Explanation

Explanation

Option D is correct because after identifying a threat on Patient 0, the next critical step in incident response is determining the lateral movement - specifically, whether the infected workstation attempted to connect to or infect other systems on the network. The fact that a second workstation in the same department shows identical behavior strongly suggests the malware spread laterally, making it essential to trace the propagation path and contain the threat before it spreads further.

Why the distractors are wrong:

• Option A is incorrect because the suspicious behavior has already been confirmed; re-examining it doesn't advance the investigation or help contain the spread.
• Option B is incorrect because analyzing the source code, while useful forensically, is not the next priority - stopping active spread takes precedence.
• Option C is incorrect because whether the file is encrypted is a secondary concern; file encryption status doesn't directly address the containment of an active infection spreading across the network.

Memory Tip

Think "contain before investigate" - when two machines show the same symptoms, your priority shifts to tracing connections between them. Ask "How did it jump?" before asking "What exactly is it?" This follows the standard incident response flow: Identification → Containment → Eradication.

No community discussion yet for this question.