Your question is Responding to Crypto Miner or Ransomware. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
A crypto miner / ransomware is running on a user's machine. How would you respond?
Asked in the onsite stage.
Explain how you would distinguish mining from ransomware, contain the endpoint, preserve evidence, assess credential and data exposure, eradicate the malware, and return the machine to service. Be specific about decision points, communications, and validation that the threat is gone.
