Ann, a user, reports to the security team that her browser began redirecting her to random sites while using her Windows laptop. Ann further reports that the OS shows the C: drive is out of space despite having plenty of space recently. Ann claims she not downloaded anything. The security team obtains the laptop and begins to investigate, noting the following: File access auditing is turned off. When clearing up disk space to make the laptop functional, files that appear to be cached web pages are immediately created in a temporary directory, filling up the available drive space. All processes running appear to be legitimate processes for this user and machine. Network traffic spikes when the space is cleared on the laptop. No browser is open. Which of the following initial actions and tools would provide the BEST approach to determining what is happening?

🎲 Try a Random Question  |  Total Questions in Quiz: 267  |  🧠 Study this quiz with Flashcards
This question is part of a full practice quiz:
CompTIA Cybersecurity Analyst Plus CySA+ CS0-001 Questions — practice the complete quiz, review flashcards, or try a random question.

The exam objectives for the CompTIA CySA+ certification exam includes threat management, cyber incident response, vulnerability, and security architecture and tool sets.. The CompTIA CySA+ exam is meant to be combined with PenTest+ to bridge the gap between the CompTIA Security+ exam, which is more generalized and a step-down, and the CompTIA Advanced Security Practitioner (CASP+), which is the highest-level certification that CompTIA offers within the Cybersecurity pathway.  The CompTIA CySA+ is more affordable, in-depth and hands-on than the CEH. The CEH, however, is more well-known and... Show more

Ann, a user, reports to the security team that her browser began redirecting her to random sites while using her Windows laptop. Ann further reports that the OS shows the C: drive is out of space despite having plenty of space recently. Ann claims she not downloaded anything. The security team obtains the laptop and begins to investigate, noting the following: <p>File access auditing is turned off.<br/> When clearing up disk space to make the laptop functional, files that appear to be cached web pages are immediately created in a temporary directory, filling up the available drive space.<br/> All processes running appear to be legitimate processes for this user and machine.<br/> Network traffic spikes when the space is cleared on the laptop.<br/> No browser is open.<br/> Which of the following initial actions and tools would provide the BEST approach to determining what is happening?<br/>