350-201 Question 32
Select 3A financial institution has detected unusual outbound traffic from their network, which they suspect is caused by a malware infection. As part of the incident response workflow, which actions should the cybersecurity team prioritize to effectively address this incident?
- A
Isolate the affected systems to prevent further spread of the malware.
- B
Perform a root cause analysis before taking any immediate action to ensure the incident is fully understood.
- C
Capture volatile data from the affected systems for forensic analysis.
- D
Communicate with stakeholders about the incident and provide regular updates on progress.
- E
Delete all suspicious files discovered on the affected systems without preserving evidence.
Show answer and explanation
Correct answers: A, C, D
Explanation
Effective incident response requires prioritizing containment, investigation, and communication. Isolating affected systems prevents further spread of the malware, capturing volatile data ensures critical evidence is preserved for forensic analysis, and communication ensures that stakeholders are informed and aligned. Root cause analysis is important but should not delay immediate actions, and deleting suspicious files without preservation of evidence contradicts forensic best practices.
- A. Correct.
Isolating the affected systems is a crucial step to prevent the malware from spreading further across the network. This is part of the containment phase in the incident response workflow.
- B. Incorrect.
While root cause analysis is important, it should not delay immediate containment actions. The primary focus should be on limiting the impact of the incident before diving into deeper analysis.
- C. Correct.
Capturing volatile data (e.g., RAM contents, active processes, or network connections) is critical for forensic analysis and understanding the nature of the malware. This is part of the investigation phase.
- D. Correct.
Communicating with stakeholders is an essential part of incident response. Keeping stakeholders informed helps ensure transparency and alignment throughout the response process.
- E. Incorrect.
Deleting suspicious files without preserving evidence is not recommended, as it can hinder forensic investigations and lead to loss of critical information about the incident.