Cisco 300-215 CBRFIR
Cisco CBRFIR 300-215 (CCNP CyberOps Forensics)
Incident Response TechniquesEnglish
Exam overviewPractice session
An IR analyst receives an alert at 02:14 about anomalous PowerShell activity on a production server. Which step belongs to the INITIAL TRIAGE phase rather than containment or eradication?
Loading your practice session…