BTL1

Practice session

During incident response, an analyst identifies an infected host actively communicating with a C2 server. According to the NIST SP 800-61 framework, what is the correct NEXT step after identification?

Loading your practice session…