Which log will generate an event with the status Contained?

The correct answer is C. An AV log with action=quarantine. The contained status is used to indicate that an event has been detected and mitigated. In the case of an AV log with action=quarantine, the malware has been detected and isolated from the

Event Management

Question

Options

AAn IPS log with action=pass.
BA WebFilter log with action=dropped.
CAn AV log with action=quarantine.
DAn AppControl log with action=blocked.

How the community answered

(43 responses)

A
12% (5)
B
7% (3)
C
79% (34)
D
2% (1)

Explanation

The contained status is used to indicate that an event has been detected and mitigated. In the case of an AV log with action=quarantine, the malware has been detected and isolated from the

Topics

#event status#contained#AV quarantine#log action mapping

Community Discussion

No community discussion yet for this question.

Full NSE5_FAZ-7.2 Practice