A security analyst is investigating malicious traffic from an internal system that attempted to download proxy avoidance software as identified from the firewall logs but the destination IP is blocked and not captured.
Which of the following should the analyst do?
A . Shut down the computer
B . Capture live data using Wireshark
C . Take a snapshot
D . Determine if DNS logging is enabled.
E . Review the network logs.
Answer: A