100-160 Question 257
Select 3During a cybersecurity incident, your team has detected unauthorized access to a critical database. As the first responder, which of the following actions align with the elements of a proper incident response process?
- A
Identify and isolate the affected system to prevent further damage.
- B
Immediately delete suspicious files to remove the threat.
- C
Document all actions taken and evidence collected during the response.
- D
Notify relevant stakeholders and escalate the incident as appropriate.
- E
Publicly announce the breach on social media for transparency.
Show answer and explanation
Correct answers: A, C, D
Explanation
The elements of a cybersecurity incident response include containment, documentation, and communication with relevant stakeholders. Properly isolating systems, maintaining evidence, and coordinating with key personnel are critical to managing the incident effectively. Deleting files prematurely or sharing details publicly can disrupt the response process and lead to further complications.
- A. Correct.
Correct: Identifying and isolating the affected system is a key step in containing the incident and preventing further compromise.
- B. Incorrect.
Incorrect: Deleting suspicious files without proper analysis can hinder investigation and destroy evidence required for forensics.
- C. Correct.
Correct: Documenting actions and evidence is essential for analysis, reporting, and potential legal proceedings.
- D. Correct.
Correct: Notifying stakeholders and escalating the incident ensures timely coordination and response from all necessary parties.
- E. Incorrect.
Incorrect: Publicly announcing the breach on social media is not part of the incident response process and can cause unnecessary panic or legal issues.