Your question is Contain and Investigate Endpoint Anomalies. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Imagine a client reports unusual activity originating from an endpoint device; walk me through your immediate containment and investigation steps.
Treat this as a practical incident-response exercise. Explain your priorities, decision points, evidence sources, containment actions, escalation criteria, and how you verify eradication before returning the endpoint to service.
