An Incident Responder needs to remediate a group of endpoints but also wants to copy a potentially suspicious file to the ATP file store. In which scenario should the Incident Responder copy a suspicious file to the ATP file store?
A) The responder needs to analyze with Cynic
B) The responder needs to isolate it from the network
C) The responder needs to write firewall rules
D) The responder needs to add the file to a whitelist

Question

Quizplus · Accepted Answer

Copying a suspicious file to the ATP file store is typically done for further analysis, such as using Cynic, which is a tool for analyzing potentially malicious files.

An Incident Responder Needs to Remediate a Group of Endpoints