フリー問題

問題文

An account that normally has limited rights was observed running administrative commands. Which action does the playbook for unauthorized elevation of privilege place first?

選択肢

1. Reset every password in the directory at once, because the alert may describe a stolen credential set.
2. Publish a notice to the affected business unit, because the alert may describe a reportable event.
3. Rebuild the host from a known good image right away, because the alert may describe a persistent implant.
4. Confirm from a separate record that the rights really changed, because the alert may describe a permitted change.