Exam 300-215 topic 1 question 2 discussion

Actual exam question from Cisco's 300-215

Question #: 2
Topic #: 1

An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process. Which two actions should the engineer take? (Choose two.)

A. Restore to a system recovery point.
B. Replace the faulty CPU.
C. Disconnect from the network.
D. Format the workstation drives.
E. Take an image of the workstation.

Show Suggested Answer

Suggested Answer: AE 🗳️

by jay_c_an at Aug. 28, 2023, 8:49 a.m.

Comments

Submit Cancel

[Removed]

8 months, 2 weeks ago

Selected Answer: AE

A-E is correct answer.

upvoted 1 times

...

greeklover84

10 months, 2 weeks ago

Selected Answer: CE

C, E fully agree with the comments !! Contain and Save evidence for forensics.

upvoted 3 times

...

RAVPN

1 year, 1 month ago

The answer is C and E. Why would you restore to a system recovery point when you haven't analyzed anything yet. Contain and analyze first.

upvoted 4 times

...

jay_c_an

1 year, 8 months ago

Contain and save evidence. CE