In a corporate environment, a cybersecurity analyst is responsible for investigating a potential intrusion on laptop endpoints. Abnormally detection systems have raised concerns about unusual…

Question

Options

• AInitiate a system-wide backup of laptop data to preserve evidence for forensic analysis.
• BCollect and analyze laptop logs and artifacts, paying attention to unusual activities, unauthorized access, and potential indicators of compromise.
• CPerform a comprehensive vulnerability assessment on all laptops to identify potential entry points for the intrusion.
• DIsolate all affected laptops from the network to prevent further communication with the attacker.

• A
  5% (1)
• B
  80% (16)
• C
  5% (1)
• D
  10% (2)

Explanation

Collecting and analyzing logs and artifacts (B) is the correct first investigative action because it directly addresses the core task: understanding what happened and how. Logs reveal unauthorized access attempts, unusual process execution, lateral movement, and indicators of compromise (IOCs) - the raw evidence needed to confirm or rule out a breach.

Why the distractors fall short:

• A (System-wide backup): Backups preserve data but don't constitute investigation; they also risk overwriting volatile memory artifacts and can introduce delays. Evidence preservation is secondary to understanding the threat scope.
• C (Vulnerability assessment): This is a proactive, pre-incident activity. Running a vuln scan during an active investigation wastes time and doesn't tell you what already happened - only what could happen.
• D (Network isolation): Isolation is a containment step, not an investigation step. Isolating before collecting logs can destroy volatile evidence (active connections, running processes, memory) and may tip off the attacker to cover tracks on other systems.

Memory tip: Think of incident response phases - Identify → Contain → Eradicate → Recover. Log and artifact analysis belongs to Identify; network isolation belongs to Contain. You must identify before you contain, making B the logical first investigative action.

No community discussion yet for this question.