Knowledge CheckPass mark 80%+60 XP

Module 1 Knowledge Check — Owning the Investigation

Pass mark 80%1 / 3

You are assigned an alert: 'suspicious service installed on WS-07'. What is the first thing a case-owner does?

A.Immediately decide whether the service binary is malicious.B.Write the investigation question, scope (host + entities + time window) and the finish line.C.Close it if the service name looks familiar.D.Escalate to IR before looking at any evidence.