100-160 Question 222
Single answerA company's cybersecurity team detects unusual traffic from an internal server to an external IP address known to be associated with malicious activity. As part of incident handling, what is the FIRST step the team should take?
- A
Isolate the affected server from the network to prevent further damage.
- B
Notify law enforcement about the malicious activity.
- C
Analyze the server's logs to identify the root cause of the issue.
- D
Restore the server from a recent backup to eliminate the potential threat.
Show answer and explanation
Correct answer: A
Explanation
The first step in effective incident handling is containment, which often involves isolating the affected system from the network. This prevents the attacker from continuing their operations, stops further data loss, and limits the scope of the incident. Other actions, such as investigating logs or restoring from backups, follow containment in the incident response process.
- A. Correct.
Isolating the affected server from the network is the correct first step to prevent further damage or data exfiltration. This containment step is critical in incident handling.
- B. Incorrect.
Notifying law enforcement is important in some cases; however, it is not the immediate first step. Containment and mitigation should occur first to limit the scope of the incident.
- C. Incorrect.
Analyzing the server's logs is part of the investigation phase, which occurs after containment. Immediate action should focus on stopping the threat.
- D. Incorrect.
Restoring the server from a backup should only be done after the threat is fully contained and analyzed. Otherwise, the backup may also be compromised or the root cause left unresolved.