Lab assessment questions & answers 1. when you are notified that a user’s workstation or system is acting strangely and log files indicate system compromise, what is the first thing you should do to the workstation or system and why? 2. when an antivirus program identifies a virus and quarantines this file, has the malware been eradicated? 3. what is the sans institute’s six-step incident handling process? 4. what is the risk of starting to contain an incident prior to completing the identification process? 5. why is it a good idea to have a security policy that defines the incident response process in your organization? 6. the post-mortem, lessons learned step is the last in the incident response process. why is this the most important step in the process?