Exam 200-201 topic 1 question 218 discussion

ill vote D

Answer:D - identifying comes before containing SANS Incident Response Steps Step #1: Preparation. Step #2: Identification. Step #3: Containment. Step #4: Eradication. Step #5: Recovery. Step #6: Lessons Learned.

Keyword: Isolated endpoint. Since it is already isolated, the next step would be to analyze the malware's behavior to know what files or data it infects or how it infects the victim computer.

The keyword is an isolated endpoint, so now you can analyze

Collect public information on the malware behavior

C. Prioritize incident handling based on the impact. In this step, the SOC team needs to assess the potential impact of the incident to determine its severity and prioritize their response accordingly. They consider factors such as the criticality of the affected system, the sensitivity of the data, and the potential for further spread or damage. By prioritizing incident handling based on impact, the team can allocate resources effectively and focus their efforts on containing and mitigating the most significant threats first. This step helps ensure an efficient and effective incident response process.

Isolating the endpoint from the network is important to prevent the malware from spreading and potentially infecting other endpoints or systems. After isolating the endpoint, the SOC team can perform an AV scan on the infected endpoint and analyze the malware behavior to determine the extent of the compromise and develop an appropriate response plan.