Free PAN-SOP Web TestEngine Demo

Q3 Single choice

High-severity detection identifies a process in an unusual directory, but the process is signed by an approved software vendor and may be part of a planned update. What should happen before disposition?

A
Compare the evidence and rule logic with the expected update behavior
B
Declare malicious activity because high severity removes the need for further validation
C
Close the alert as benign because a valid signature establishes expected behavior
D
Isolate the endpoint first and inspect evidence only after business impact is known

PAN-SOP Web TestEngine demo