Exam 200-201 topic 1 question 186 discussion

Personally I would isolate before doing ANYTHING else!

B " narrowed the executable file's type to a new trojan family" means it is investigated and proved it is a trojan. Action is needed here.

From a SOCs point of view, I would research first the malware behavior on what parts of the network or system it would likely target first since malwares tend to have "variations", at least know how the malware behaves first before performing intrusive actions. Determine first the impact before you isolate an endpoint since in the real world scenario, you're currently running an AV, EDR or XDR and you'll mostly do non-intrusive activities.

When reading appendix G in the NIST 800-61 (r2) document I would say it's step 3 "Analyze the evidence to confirm that an incident has occurred." which would be D. I would think removing it from the network would be step 6 "Stop the incident if it is still in progress" TBH I would disconnect it isolate it first so it can't spread further but I think the correct answer is D. Tricky question...

Isolating the PC may cause damage to the PC. It could set off another attack which encrypts the host. You should 1st analyze the malware I believe, but not with these questions I can't say for sure

Prioritize incident handling based on the impact

The answer is B

You found a new trojan on your network on an endpoint. What do you do next? I think you should isolate. Answer B