The incident handler should clone any impacted hard drives to preserve evidence for possible litigation1

Sandbox testing is a method of identifying potential issues with a proposed change prior to implementation. It involves creating a simulated or isolated environment that mimics the real system and applying the change to it. This can help to verify that the change works as expected and does not cause any errors or conflicts.
Request form, rollback plan and end-user acceptance are other components of a change management process, but they do not involve identifying issues with a change. Verified References: https://www.comptia.org/blog
/what-is-sandbox-testing https://www.comptia.org/certifications/a

Explanation
The correct answers are E and F. Disabling AutoRun and updating the antivirus definitions are two actions that should be taken to prevent the incident from happening again.
AutoRun is a feature of Windows that automatically executes a predetermined action when a removable media such as a USB drive is inserted in a computer. For example, AutoRun can launch or install a new program on the media, or open the file in File Explorer. However, this feature can also be exploited by malicious software that can run without the user's consent or knowledge. Therefore, disabling AutoRun can help prevent accidental installation of viruses and other malware from USB drives123.
Updating the antivirus definitions is another important action that can help prevent malware infections from USB drives. Antivirus definitions are files that contain information about the latest known threats and how to detect and remove them. By updating the antivirus definitions regularly, you can ensure that your antivirus software can recognize and block any malicious software that may be on the USB drive before it can harm your computer45.
A host-based IDS is a system that monitors and analyzes the activity on a single computer or device for any signs of intrusion or malicious behavior. A host-based IDS can help detect and prevent malware infections from USB drives, but it is not a sufficient action by itself. A host-based IDS needs to be complemented by other security measures, such as disabling AutoRun and updating the antivirus definitions6.
Restricting login times, enabling a BIOS password, and updating the password complexity are all actions that can help improve the security of a computer or device, but they are not directly related to preventing malware infections from USB drives. These actions can help prevent unauthorized access to the computer or device, but they do not affect how the computer or device interacts with the USB drive or its contents.
Restricting user permissions is an action that can help limit the damage that malware can cause on a computer or device, but it does not prevent the malware from being installed in the first place. Restricting user permissions means limiting what actions a user can perform on the computer or device, such as installing or deleting programs, modifying system settings, or accessing certain files or folders. By restricting user permissions, you can reduce the impact of malware infections by preventing them from affecting other users or system components7.

The Network & Internet settings in Windows 10 allow the user to input the SSID and password of a Wi-Fi network, as well as manage other network-related options, such as airplane mode, mobile hotspot, VPN, proxy, etc1. To access the Network & Internet settings, the user can select the Start button, then select Settings > Network & Internet2. Alternatively, the user can right-click the Wi-Fi icon on the taskbar and click
"Open Network & Internet Settings"3.
The System settings in Windows 10 allow the user to configure the display, sound, notifications, power, storage, and other system-related options1. The Personalization settings in Windows 10 allow the user to customize the background, colors, lock screen, themes, fonts, and other appearance-related options1. The Accounts settings in Windows 10 allow the user to manage the user accounts, sign-in options, sync settings, and other account-related options1. None of these settings can be used to input the SSID and password of a Wi-Fi network.
References:
The Official CompTIA A+ Core 2 Study Guide1, page 221, 222, 223, 224.

See the Full solution in Explanation below.
Explanation:
Classification: a) Phishing
This email is a phishing attempt, as it tries to trick the user into clicking on a malicious link that could compromise their account or personal information. Some suspicious items in this email are:
* The email has a generic greeting and does not address the user by name.
* The email has spelling errors, such as "unusal" and "Locaked".
* The email uses a sense of urgency and fear to pressure the user into clicking on the link.
* The email does not match the official format or domain of the IT Help Desk at CompTIA.
* The email has two black bat icons, which are not related to CompTIA or IT support.
The appropriate resolution for this email is A. Report email to Information Security. The user should not click on the link, reply to the email, or provide any personal or account information. The user should forward the email to the Information Security team or use a professional email form to report the phishing attempt. The user should also delete the email from their inbox and trash folder.
The suspicious items to select are:
* b) From address
* d) Hyperlinks
These items indicate that the email is not from a legitimate source and that the link is potentially malicious.
The other items are not suspicious in this case, as the to address is the user's own email and there are no attachments.

Classification: b) Spam
This email is a spam email, as it is an unsolicited and unwanted message that tries to persuade the user to participate in a survey and claim a reward. Some suspicious items in this email are:
* The email offers a free wireless headphone as an incentive, which is too good to be true.
* The email does not provide any details about the survey company, such as its name, address, or contact information.
* The email contains an external survey link, which may lead to a malicious or fraudulent website.
* The email does not have an unsubscribe option, which is required by law for commercial emails.
The appropriate resolution for this email is C. Unsubscribe. The user should look for an unsubscribe link or button at the bottom of the email and follow the instructions to opt out of receiving future emails from the sender. The user should also mark the email as spam or junk in their email client, which will help filter out similar emails in the future. The user should not click on the survey link, reply to the email, or provide any personal or financial information.

Classification: c) Legitimate
This email is a legitimate email, as it is from a trusted source and has a valid purpose. There are no suspicious items in this email, as the from address, the to address, the attachment, and the email body are all consistent and relevant. The appropriate resolution for this email is B. Perform no additional actions. The user can open the attachment and review the orientation material as instructed. The user does not need to report, unsubscribe, or delete this email.
A screenshot of a computer Description automatically generated

Classification: a) Phishing
This email is a phishing attempt, as it tries to deceive the user into downloading and running a malicious attachment that could compromise their system or data. Some suspicious items in this email are:
* The email has a generic greeting and does not address the user by name or username.
* The email has an urgent tone and claims that a security patch needs to be installed immediately.
* The email has an attachment named "patch1.exe", which is an executable file that could contain malware or ransomware.
* The email does not match the official format or domain of CompTIA Information Security.
The appropriate resolution for this email is A. Report email to Information Security. The user should not open the attachment, reply to the email, or provide any personal or account information. The user should forward the email to the Information Security team or use a professional email form to report the phishing attempt. The user should also delete the email from their inbox and trash folder.
A screenshot of a computer Description automatically generated


Classification: c) Legitimate
This email is a legitimate email, as it is from a trusted source and has a valid purpose. There are no suspicious items in this email, as the from address, the to address, and the email body are all consistent and relevant. The appropriate resolution for this email is B. Perform no additional actions. The user can reply to the email and thank the sender for the interview opportunity. The user does not need to report, unsubscribe, or delete this email.
A screenshot of a computer Description automatically generated