Cyber Fundamentals Block 5 Practice Exam

When an event is described as undergoing further review, the situation is still in the analysis phase. The best fit is to label it as an Investigation because analysts are actively gathering evidence, validating indicators, and determining the scope and impact before deciding on the next steps. This category signals ongoing analysis rather than a finalized conclusion. A explained anomaly would come after the root cause is identified and documented, which isn’t implied by “undergoing further review.” Denial of Service refers to an actual service disruption caused by flooding or resource exhaustion, which isn’t indicated here. Non-compliance activity points to a policy or regulatory violation, which also isn’t established yet.