Exam 350-201 topic 1 question 20 discussion

This dump is no longer valid. Took the exam yesterday and only around 8 of 101 questions there.

Collect log data: Collecting log data is the first step to understand the extent and nature of the incident, including the scope of unauthorized access and system changes that have occurred. Identify systems to be taken offline: Identifying systems that have been compromised or exposed to the unauthorized software is crucial to prevent further damage and contain the incident. Conduct content scans: Conducting content scans can help identify any other unauthorized software or malicious files that may have been installed on the network. Request system patch: Requesting a system patch may help mitigate the vulnerability that led to the escalation of privilege attack, and prevent future attacks of a similar nature. Reimage: Reimaging the affected system may be necessary if the system has been compromised to a degree that it cannot be remediated through other means. It is important to note that the order of these activities may vary depending on the specifics of the incident, and they may need to be conducted concurrently to ensure a timely and effective response. - ChatGPT