Q: 2
A security team is notified from a Cisco ESA solution that an employee received an advertising email
with an attached .pdf extension file. The employee opened the attachment, which appeared to be an
empty document. The security analyst cannot identify clear signs of compromise but reviews running
processes and determines that PowerShell.exe was spawned by CMD.exe with a grandparent
AcroRd32.exe process. Which two actions should be taken to resolve this issue? (Choose two.)
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
