350-201 Question 30
Select 3A cybersecurity analyst at your organization detects unusual outbound traffic from a server that might indicate a potential data exfiltration. According to the incident response workflow, which of the following actions should the analyst take to ensure proper incident handling?
- A
Identify and classify the incident based on its impact and severity.
- B
Immediately shut down the server to prevent further data loss.
- C
Notify relevant stakeholders and escalate the issue, if necessary.
- D
Document all findings and actions taken during the investigation.
- E
Deploy a patch to prevent further exploitation of the vulnerability.
Show answer and explanation
Correct answers: A, C, D
Explanation
The incident response workflow involves a structured approach to handling security incidents. Key steps include identifying and classifying the incident, notifying stakeholders, and documenting all actions. Shutting down the server prematurely or deploying patches outside the appropriate phase can hinder investigation efforts and disrupt the workflow.
- A. Correct.
Correct: Identifying and classifying the incident is a critical first step in the incident response workflow, as it helps determine the severity and the appropriate course of action.
- B. Incorrect.
Incorrect: Immediately shutting down the server may result in the loss of valuable forensic data and should only be done in extreme cases as a last resort.
- C. Correct.
Correct: Notifying stakeholders and escalating the issue ensures that the right teams are informed and can respond promptly.
- D. Correct.
Correct: Documenting findings and actions is essential for creating a detailed incident report, which can inform future prevention measures and legal proceedings, if necessary.
- E. Incorrect.
Incorrect: Deploying a patch is part of the remediation phase and should only occur after containment, eradication, and investigation phases are complete.