Free practice · multiple-choice · hard

Practice

Review a connected workplace incident

Northstar learns that a lost laptop was signed in, a vendor bank-change message was sent from a worker's account, and shared files may have been viewed. Which actions belong in the coordinated beginner handoff?

Beginner incident handoff

Stop harm, preserve facts, and support authorized recovery

  1. StopEnd the risky action
  2. ContainUse only authorized instructions
  3. ReportShare assets, time, facts, and actions
  4. PreserveKeep evidence and a factual timeline
  5. CoordinateSupport scope and business decisions
  6. RecoverVerify clean service and improve controls

A strong beginner response is prompt and factual without becoming an unauthorized investigation, cleanup, payment, or public-communication effort.

Choose all that apply