Contain an incident without losing its evidence

Time UTC	Observation
06:12	New scheduled task executes an unknown helper every 10 minutes
06:16	Service identity creates an unapproved cloud access key
06:18	A network session to an unapproved destination remains established
06:20	Only filesystem logs have been copied; memory and session data remain volatile

Time UTC

Observation

06:12

New scheduled task executes an unknown helper every 10 minutes

06:16

Service identity creates an unapproved cloud access key

06:18

A network session to an unapproved destination remains established

06:20

Only filesystem logs have been copied; memory and session data remain volatile

Proposed close condition: host is rebuilt and application returns HTTP 200. Known gap: cloud access key is still valid and the replacement host uses the old service secret. Evidence custody: image ID CDR-9, SHA-256 recorded at acquisition, read-only original, working copy for analysis.

single choice

What does mapping the repeated scheduled task to a persistence technique establish?

2 pts

A behavior classification that helps choose hunts and detection checks The identity of the threat actor with certainty Proof that every stage of an attack framework occurred Confirmation that the scheduled task was the initial access vector

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

single choice

Which coordinated action fits the authorization and evidence constraints?

2 pts

Keep the host fully connected until every investigation is complete Restore the last disk backup and assume all external credentials are revoked Begin the authorized volatile capture, then isolate APP-9; revoke the identity in parallel after its audit evidence is preserved Fail over to the standby and rebuild APP-9 immediately, then collect logs from the rebuilt host

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

single choice

Which additional custody record is most useful when an analyst receives the working copy?

2 pts

Record who transferred and received it, when, why, and the verified digest Keep only the digest and discard the transfer history Recompute the digest after analysis and replace the acquisition value with it Note in the ticket which analysis share holds the copy

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

multi select

Select the THREE checks needed before declaring the supplied recovery complete.

3 pts

Rotate the affected service secret and validate least-privilege access Validate clean service behavior and monitor for the observed persistence or related activity Treat HTTP 200 alone as proof that the incident is eradicated Confirm the scheduled-task alert no longer fires on the retired APP-9 image Verify the unauthorized cloud key and old sessions no longer work

Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

Original practice · Review pending

Inspect the evidence

Incident record

Recovery proposal

Complete the response

What does mapping the repeated scheduled task to a persistence technique establish?

Which coordinated action fits the authorization and evidence constraints?

Which additional custody record is most useful when an analyst receives the working copy?

Select the THREE checks needed before declaring the supplied recovery complete.

Review your result

Attempt history

Question or answer look wrong?