Which log will generate an event with the status Contained?

The correct answer is C. An AV log with action=quarantine. The contained status is used to indicate that an event has been detected and mitigated. In the case of an AV log with action=quarantine, the malware has been detected and isolated from the

Event Management

Question

Options

AAn IPS log with action=pass.
BA WebFilter log with action=dropped.
CAn AV log with action=quarantine.
DAn AppControl log with action=blocked.

How the community answered

(28 responses)

A
4% (1)
B
11% (3)
C
82% (23)
D
4% (1)

Explanation

The contained status is used to indicate that an event has been detected and mitigated. In the case of an AV log with action=quarantine, the malware has been detected and isolated from the

Topics

#event status#AV quarantine#contained status#log action mapping

Community Discussion

No community discussion yet for this question.

Full FCP_FAZ_AD-7.4 Practice