Cert Master

KT-DP Removable media

A found USB drive is plugged into a SOC analyst machine 'to see who lost it.' What is the SAFE procedure?

Multiple choice — select one answer

Answer choices

  1. a. Open on the analyst daily workstation, without security or identity team coordination per policy.
  2. b. Email the files to the whole team, without security or identity team coordination per policy.
  3. c. Insert into the domain controller to scan faster, without security or identity team coordination per policy.
  4. d. Analyze only in a dedicated malware sandbox VM disconnected from production

Architectural breakdown & explanation

Unknown USBs are bait; sandbox isolation prevents accidental infection.

Correct answer(s): d. Analyze only in a dedicated malware sandbox VM disconnected from production

Exam domain: Removable media (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Data Protection bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications