CompTIA
SY0-501 · Question #334
A security analyst notices anomalous activity coming from several workstations in the organizations. Upon identifying and containing the issue, which of the following should the security analyst do NE
Sign in or unlock SY0-501 to reveal the answer and full explanation for question #334. The question stem and answer options stay visible for context.
Submitted by javi_es· Mar 4, 2026Security operations
Question
A security analyst notices anomalous activity coming from several workstations in the organizations. Upon identifying and containing the issue, which of the following should the security analyst do NEXT?
Options
- ADocument and lock the workstations in a secure area to establish chain of custody
- BNotify the IT department that the workstations are to be reimaged and the data restored for
- CNotify the IT department that the workstations may be reconnected to the network for the
- DDocument findings and processes in the after-action and lessons learned report
Unlock SY0-501 to see the answer
You've previewed enough free SY0-501 questions. Unlock SY0-501 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#incident response#after-action report#lessons learned#IR lifecycle