Triage a compromised workstation

Time	Event	Source	Result
08:41	Interactive sign-in	198.51.100.42 / Chicago	a.chen — 8 failures
08:44	Interactive sign-in	198.51.100.42 / Chicago	a.chen — success; push approved
08:48	Refresh-token use	203.0.113.77 / Amsterdam	a.chen — success; unmanaged device
08:52	Directory audit	203.0.113.77 / Amsterdam	a.chen added svc-backup to Billing Admins

01

multi select

Select the FOUR observations that most strongly support an active identity-and-endpoint compromise.

4 pts

The user denies both the approved push and opening the document shown in telemetry A refresh token was used from an unmanaged Amsterdam device four minutes after the Chicago sign-in Word launched encoded PowerShell, which then launched rundll32 against a public-profile DLL The same remote source performed an unexpected privileged-group change as a.chen Eight failed sign-ins occurred before a successful sign-in A signed Outlook process was running on the workstation The built-in whoami utility exists on the workstation

Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

02

multi select

Select the THREE immediate actions that best contain the active paths while preserving investigation options.

3 pts

Network-isolate WKSTN-22 through EDR, keep it powered, and begin volatile-data collection Revoke a.chen's sessions and tokens, then secure the identity under the incident playbook Remove the unexpected Billing Admins grant and suspend svc-backup pending owner validation Immediately wipe and reimage WKSTN-22 before collecting additional evidence Block all outbound internet access for every corporate endpoint Ask the user to delete invoice_aug.docm and continue working until reconciliation ends

Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

03

matching

Match each collection action to the question it is best suited to answer.

4 pts

Capture memory, active connections, and running processes from the isolated host → Export identity sign-in, token, and directory-audit records → Export the EDR process tree and PowerShell operational logs → Acquire and hash a forensic disk image with chain-of-custody records →

Need a hint?

Start with the row and choice that have the most distinctive purpose, then use that pair to narrow the rest.

Show another hint

For each remaining pair, explain the relationship in one sentence before selecting it.

04

single choice

Which next investigation query most directly tests whether the incident spread beyond a.chen and WKSTN-22?

2 pts

Hunt across EDR, DNS/proxy, and identity logs for the same DLL hash, destinations, token source, and privilege-change pattern Run one antivirus scan on WKSTN-22 and stop if it reports clean Ask the user whether the workstation has recently felt slower Close the incident because the known workstation and account are contained

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

05

ordering

After immediate containment and volatile collection, order the remaining response work.

5 pts

Drag the rows or use the arrow buttons to reorder.

1 Export the relevant logs and acquire a verified image under chain of custody
2 Rebuild the endpoint and remove confirmed persistence and unauthorized access
3 Restore from a trusted state with secured credentials and validate business functions
4 Monitor the restored host, identity, and related indicators for recurrence
5 Document lessons learned and tune controls and detections

Use this order as my answer

Need a hint?

Identify the prerequisite that must happen first and the verification or documentation that belongs last.

Show another hint

For the middle steps, ask what must already be true before each action can safely happen.

Original practice · Review pending

Inspect the evidence

Identity events

Endpoint process tree

Complete the response

Select the FOUR observations that most strongly support an active identity-and-endpoint compromise.

Select the THREE immediate actions that best contain the active paths while preserving investigation options.

Match each collection action to the question it is best suited to answer.

Which next investigation query most directly tests whether the incident spread beyond a.chen and WKSTN-22?

After immediate containment and volatile collection, order the remaining response work.

Review your result

Attempt history

Question or answer look wrong?