Question

A financial analyst's laptop triggered a DLP alert indicating that a spreadsheet tagged as confidential was copied to an external device. As the SOC analyst assigned to investigate this potential endpoint data loss, which action should you take FIRST to confirm the exfiltration and preserve evidence?

Accepted Answer

Review the endpoint's device connection and file-transfer logs to correlate the removable-media insertion event with the file access and copy activity

Answer

Reimage the laptop immediately to eliminate any malware that may have facilitated the transfer

Answer

Block all USB mass-storage devices across the enterprise via group policy

Answer

Notify the analyst's manager and open an HR disciplinary case