Cisco Discussions

Exam 300-215 All Questions

View all questions & answers for the 300-215 exam

Go to Exam

Exam 300-215 topic 1 question 2 discussion

Actual exam question from Cisco's 300-215

Question #: 2
Topic #: 1

[All 300-215 Questions]

An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

A. Restore to a system recovery point.
B. Replace the faulty CPU.
C. Disconnect from the network.
D. Format the workstation drives.
E. Take an image of the workstation.

Show Suggested Answer

Suggested Answer: CE 🗳️

by jay_c_an at Aug. 28, 2023, 8:49 a.m.

Comments

Submit Cancel

greeklover84

1 year ago

Selected Answer: CE

C, E fully agree with the comments !! Contain and Save evidence for forensics.

upvoted 3 times

...

RAVPN

1 year, 3 months ago

The answer is C and E. Why would you restore to a system recovery point when you haven't analyzed anything yet. Contain and analyze first.

upvoted 4 times

...

jay_c_an

1 year, 10 months ago

Contain and save evidence. CE

upvoted 4 times

...