100-160 Question 225
Select 3A company receives an alert indicating suspicious activity on one of its servers. The security team needs to respond quickly to contain the threat and prevent further damage. Which of the following steps should be performed as part of the incident handling process?
- A
Isolate the affected server from the network to prevent lateral movement.
- B
Delete all log files on the server to prevent attackers from accessing them.
- C
Perform an analysis of the server's activity to identify the scope of the attack.
- D
Notify relevant stakeholders about the incident and provide status updates.
- E
Immediately reinstall the operating system without attempting to gather evidence.
Show answer and explanation
Correct answers: A, C, D
Explanation
Incident handling involves a systematic approach to detecting, containing, analyzing, and responding to security incidents. Key steps include isolating affected systems, conducting analysis to understand the attack, and keeping stakeholders informed. Deleting evidence or rushing to reinstall systems before gathering data can lead to poor understanding of the incident and missed opportunities to improve security.
- A. Correct.
Isolating the affected server is a critical containment step to prevent the threat from spreading to other systems within the network.
- B. Incorrect.
Deleting log files is not recommended as it hinders the investigation process. Logs are essential for understanding the nature and scope of the attack.
- C. Correct.
Analyzing the server's activity helps the team identify the attack's impact and determine appropriate remediation steps.
- D. Correct.
Notifying stakeholders ensures that all relevant parties are aware of the incident and that proper organizational response measures can be coordinated.
- E. Incorrect.
Reinstalling the operating system without gathering evidence destroys important forensic data that could help identify the attacker and improve security measures.