// final assessment

Final Exam

12 scenario-based questions · Pass at 80% to earn your certificate

Question 1 of 12

A file server is actively encrypting files at 3 AM. The SOC analyst has network isolation capability (VLAN change) and EDR kill process capability. The analyst also has a memory acquisition tool ready. In what order should these actions be performed?