Exam 350-201 topic 1 question 79 discussion

When multiple shortcuts in the system's startup folder redirect to malicious URLs, the next step is to identify all affected systems. This is crucial to understand the scope of the issue and to prevent further spread of the malware. Removing the shortcuts (option A) is a necessary step but should be done after identifying all affected systems to ensure a comprehensive response. Checking the audit logs (option B) and investigating the malicious URLs (option D) are also important steps, but they come after identifying all systems that might be compromised

The next step the engineer should take to investigate this case is to identify affected systems. Since multiple employees have reported system crashes within the same week, it is likely that other systems have been affected. By identifying affected systems, the engineer can take steps to remove the malicious shortcuts and investigate if there are any other related security issues. Once the affected systems have been identified, the engineer can nvestigate the malicious URLs and check the audit logs to determine how the malicious shortcuts were created and who created them. - ChatGPT