Incident Responder

Correct answer: C

Option C is correct because trend analysis and reporting requires aggregating signal across accounts and time to detect patterns invisible to single-account thresholds, then communicating the finding with evidence so leadership can act. Closing the observation is wrong because relying solely on the existing per-account threshold ignores the very pattern under analysis: a distributed attack is designed to stay under per-account thresholds. Forcing an organization-wide password reset is wrong because it is a disruptive, resource-intensive response taken before the analysis confirms whether the pattern is malicious, benign, or something else. Holding the observation for the next quarterly report is wrong because trend analysis and reporting exists to surface emerging risks proactively; deferring to a fixed reporting cadence defeats that purpose and risks letting a live credential attack continue unaddressed.

This question measures: T0164: Perform cyber defense trend analysis and reporting

Correct answer: C

For an active, domain-wide compromise in which an intruder still holds domain admin and is creating accounts in real time, standard incident response practice is to contain quietly while rapidly scoping the full extent of the compromise, then evict the intruder in a single coordinated eradication. A noisy or partial response warns an adversary who can then accelerate damage, deepen persistence, or go dormant and return later, so the correct first move isolates the affected hosts and expands monitoring while a small team maps lateral movement and persistence before one coordinated eradication. Disabling the account and resetting every domain admin credential tonight acts before the scope is known and is exactly the visible, partial eviction that tips off the intruder while other footholds remain, so it is wrong. Capturing full forensic images of every reachable server before doing anything and deferring containment until imaging is finished over-prioritizes evidence preservation over timely containment of an actively escalating intrusion, and volatile evidence can be captured as part of containment rather than by halting the response, so it is wrong. Powering off every reachable server cuts access but destroys the volatile memory and running-process evidence needed to understand the intrusion and still leaves the scope unmapped, so it is wrong.

This question measures: K0724: Knowledge of incident response principles and practices

Correct answer: C

Option C follows both the order of volatility and the priority of stopping active attacker access without destroying evidence: EDR based network isolation contains the host immediately while leaving it powered on, so the most fragile evidence, memory, can still be captured right afterward, and disk imaging follows only once that memory capture is secured. This sequence halts the intrusion, preserves volatile and persistent evidence, and keeps the server available enough to support a later decision on quarter end close impact. The 'power off immediately' option reflects a common but mistaken instinct that cutting power halts the intrusion and protects the evidence; in fact EDR isolation already stops the attacker's network access, and powering off before memory is captured destroys RAM contents, open connections, and process data that cannot be recovered afterward. The 'capture memory before containment' option gets the order of volatility right in isolation but reverses the priority that matters most during an active intrusion: delaying isolation until after the memory capture leaves the attacker's network access open for longer than necessary, and since EDR based isolation does not power off the host or alter its memory, there is no acquisition benefit to postponing it. The 'disk image first' option gets the sequence backward: waiting on a full disk image before addressing memory means the contents of RAM, including active network connections and running processes, are placed at continued risk of being overwritten or lost, regardless of how disk evidence is weighed in later proceedings.

This question measures: K0725: Knowledge of incident response tools and techniques