3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary objective of the initial step in investigating a potential endpoint intrusion?

   • ATo install additional security software on the endpoint
   • BTo immediately remediate the endpoint by reimaging the system
   • CTo identify the scope of the intrusion and preserve volatile data
   • DTo notify law enforcement and regulatory bodies
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team is investigating a breach that affected a Windows laptop, a Linux server, and a mobile device. The team has collected logs from all three. Management wants a single report that explains the attack path. What is the best way to produce this report?

   • AWrite separate reports for each device and attach them together
   • BCorrelate the logs to create a timeline of events across all devices
   • CFocus the report on the most critical device only
   • DSummarize the logs without analysis
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An analyst is investigating a macOS laptop and a Windows desktop that both show signs of the same malware family. The analyst has limited time and must determine if the infections are related. What is the most efficient analysis technique?

   • APerform a deep dive into the macOS malware's code
   • BCompare the malware hashes and network indicators from both systems
   • CReview the macOS system logs only
   • DCheck the Windows Event Logs for user logons
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which activity is a common objective when investigating an intrusion on an IoT device?

   • ARecovering deleted emails from the device's mail client
   • BAnalyzing the device's browser history for malicious websites
   • CExtracting the device's BitLocker encryption keys
   • DDetermining whether the device firmware has been modified
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An organization has a mix of Windows laptops, Linux servers, and IoT sensors. A breach is suspected. The team must preserve evidence while minimizing business disruption. Which approach best balances these needs?

   • ACollect evidence only from the IoT sensors because they are most vulnerable
   • BOnly image the servers and ignore laptops and IoT sensors
   • CImmediately shut down all devices to preserve evidence
   • DCapture volatile data from all devices first, then image storage devices in order of criticality
   Reveal Solution Discussion Select an answer first