Exam CS0-001 topic 1 question 351 discussion

Isolate without investigating properly?

This question is on the exam.

the first step is to investigate the cause behind the increased CPU usage. This includes examining the processes running on the server, checking for unusual or unexpected activities, and reviewing logs for any signs of compromise or exploitation. A thorough investigation will help determine whether the issue is a malicious activity or not.

isolate then investigate

If it was a business critical production server the isolation could be problematic to say the least. However this is R&D so isolate and then investigate.

Already server is in a critical condition, High User and Processors. Without isolating the server how you perform the investigation such instance. Also ideally, investigation already performed by the snippet. it clearly indicates something unusual thing going on. So i go with Isolation

Plenty of perfectly valid reasons for CPU spikes. Isolating before investigating thoroughly is going off half-cocked, and you should probably be fired.

it is B because and investigation as already been initiated i.e The CISO asking the security Analyst to examine the server is an investigation initiation. what comes next should be isolation which is B

I also think its A, The keyword in the question states "Examine" which is like start investigation.You isolate when you have done vulnerability scan and confirm there is an incidence and scanning is examination first. i dont know how its B though

The right answer is A. This almost comes straight from https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf. The activity is an "indicator" - not yet an incident! - and the first step we need to do is "Incident Analysis" to confirm that this even an incident to begin with. So to summerize: A would be first. Depending on the outcome of the investigation, it would then be B or D (B - which is part of the Containment process - in case it is an incident, D in case it isn't). And lastly, we'd move to C, which is part of the Eradication process.