200-201 Question 346
Select 3An organization has detected unusual outbound traffic from an internal server. As a security analyst, you suspect that the server has been compromised and is being used to exfiltrate sensitive data. Which of the following actions should you prioritize to contain the incident and prevent further damage?
- A
Disconnect the server from the network immediately.
- B
Perform a full forensic analysis on the server before taking any action.
- C
Isolate the server in a quarantine environment.
- D
Update the server's operating system and software while it is still online.
- E
Notify relevant stakeholders about the incident.
Show answer and explanation
Correct answers: A, C, E
Explanation
When dealing with a suspected compromised server, the priority is to contain the threat and prevent further damage. Disconnecting or isolating the server prevents ongoing malicious activity, while notifying stakeholders ensures that all necessary parties are aware of the situation and can take coordinated action. Forensic analysis and updates can be performed after containment to avoid escalating the attack.
- A. Correct.
Disconnecting the server from the network immediately helps prevent further data exfiltration and halts any ongoing malicious activity.
- B. Incorrect.
Performing a forensic analysis before taking any action is not recommended, as it may allow the attacker to continue exfiltrating data or escalate the attack.
- C. Correct.
Isolating the server in a quarantine environment is a critical containment step to allow further investigation while preventing interaction with other systems.
- D. Incorrect.
Updating the server while it is still online risks further compromise and does not address the immediate threat of data exfiltration.
- E. Correct.
Notifying stakeholders ensures proper communication and coordination during the incident response process, which is essential for effective containment and resolution.