Exam 350-201 topic 1 question 6 discussion

Answer is D, the simplest logic is that the attacker is already in the premises so you cant say "A" is an answer because the attacker has followed an "authorized individual" so he basically piggy backed him to enter -- the best answer would be to track him down.

At this stage, the following step should be taken: D. Identify movement of the attacker in the enterprise. The first step in responding to any security incident is to identify the scope and extent of the incident. In this case, an unauthorized individual followed an authorized individual to enter a secured premise. Therefore, the security specialist should identify the movement of the attacker in the enterprise, including where the attacker went and what the attacker did while on the premises. Once the movement of the attacker is identified, the security specialist can take appropriate action to contain the incident and minimize any damage or risk. The other options (A, B, and C) may also be important steps in a larger incident response plan, but they are not the appropriate next step in this specific scenario.

D Is the answer

"documented & given to analyze", which steps taken at this stage? It doesn't confirm an atacker exists (not A) and I wouldn't change anything until I have finished analyzing (Not C). First Identify where the person has been, who they are etc. He might be the new guy and you are lableing him as an attacker, If he seems unusual/mischievous then proceed with ABC.My Answer is: D

Hello J-Dub. Not yet. How about you?

My choice is C: Change access controls to high risk assets in the enterprise.