Candidate Questionnaire: Incident Response

You've received the alert below:

The following raw event log is attached:

You have received the alert “Network Device Down” for a customer. After investigating, you have found that a firewall went offline 15 minutes ago and several user devices appear to be offline as a result. The device has not yet come back online.

The Incident Response Plan for this customer is as follows:

You've received the alert below:

The following raw event log is attached:

You have received an Endpoint Detection and Response (EDR) alert that says that a malicious process has been detected and has been blocked on a customer device. The information for the file is below: