Cisco
350-201 · Question #51
350-201 Question #51: Real Exam Question with Answer & Explanation
Sign in or unlock 350-201 to reveal the answer and full explanation for question #51. The question stem and answer options stay visible for context.
Processes
Question
A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?
Options
- AClassify the criticality of the information, research the attacker's motives, and identify missing
- BDetermine the damage to the business, extract reports, and save evidence according to a chain
- CClassify the attack vector, understand the scope of the event, and identify the vulnerabilities being
- DDetermine the attack surface, evaluate the risks involved, and communicate the incident
Unlock 350-201 to see the answer
You've previewed enough free 350-201 questions. Unlock 350-201 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#incident response#evidence handling#chain of custody#software integrity