An Incident Response Team Has Determined That Multiple Incidents Are

question 287

Multiple Choice

An incident response team has determined that multiple incidents are resulting from the same user action of copying sensitive data to USB devices. Which action should the incident response team take to fix this issue so only one incident per action is detected?

• A) create separate policies for the different detection methods
• B) combine multiple conditions into one compound rule
• C) change which 'Endpoint Destinations' are monitored
• D) change the monitor/ignore filters in the agent configuration

---

Definitions:

Plasma

The liquid component of blood, comprising about 55% of its volume, in which cells and other components are suspended.

Liquid portion

The liquid component of a substance, often referred to in contexts such as blood, where it is the part not containing cells.

Blood cells

Cells that circulate in the bloodstream, comprising red blood cells (erythrocytes), white blood cells (leukocytes), and platelets (thrombocytes).

Hemoglobin

A protein in red blood cells responsible for carrying oxygen throughout the body.