An Incident Responder notices traffic going from an endpoint to an IRC channel. The endpoint is listed in an incident. ATP is configured in TAP mode. What should the Incident Responder do to stop the traffic to the IRC channel?
A) Isolate the endpoint with a Quarantine Firewall policy
B) Blacklist the IRC channel IP
C) Blacklist the endpoint IP
D) Isolate the endpoint with an application control policy

Question

Quizplus · Accepted Answer

The Answer of An Incident Responder notices traffic going from an endpoint to an IRC channel. The endpoint is listed in an incident. ATP is configured in TAP mode. What should the Incident Responder do to stop the traffic to the IRC channel?
A) Isolate the endpoint with a Quarantine Firewall policy
B) Blacklist the IRC channel IP
C) Blacklist the endpoint IP
D) Isolate the endpoint with an application control policy

An Incident Responder Notices Traffic Going from an Endpoint to an IRC