An Incident Responder Needs to Remediate a Group of Endpoints

Multiple Choice

An Incident Responder needs to remediate a group of endpoints but also wants to copy a potentially suspicious file to the ATP file store. In which scenario should the Incident Responder copy a suspicious file to the ATP file store?

A) The responder needs to analyze with Cynic
B) The responder needs to isolate it from the network
C) The responder needs to write firewall rules
D) The responder needs to add the file to a whitelist