Which of the following response actions should the analyst take FIRST?

exams CAS-004 CAS-004 exam 0 Comments

A security analyst notices a number of SIEM events that show the following activity:

Which of the following response actions should the analyst take FIRST?
A . Disable powershell.exe on all Microsoft Windows endpoints.
B . Restart Microsoft Windows Defender.
C . Configure the forward proxy to block 40.90.23.154.
D . Disable local administrator privileges on the endpoints.

Answer: A