Which two actions should the engineer take?

An engineer is investigating a ticket from the accounting department in which a user discovered an unexpected application on their workstation. Several alerts are seen from the intrusion detection system of unknown outgoing internet traffic from this workstation. The engineer also notices a degraded processing capability, which complicates the analysis process.

Which two actions should the engineer take? (Choose two.)
A . Restore to a system recovery point.
B . Replace the faulty CP
D . Disconnect from the network.
E . Format the workstation drives.
F . Take an image of the workstation.

View Answer

Answer: AE