Cisco
100-160 · Question #49
100-160 Question #49: Real Exam Question with Answer & Explanation
Sign in or unlock 100-160 to reveal the answer and full explanation for question #49. The question stem and answer options stay visible for context.
Question
During an incident response, the security team needs to isolate a compromised server from the rest of the network but still allow forensic analysis. Which action should they take?
Options
- APower off the server immediately.
- BDisconnect the server from the network and connect it to an isolated forensic network.
- CDelete suspicious files from the server.
- DReset all user passwords on the server.
Unlock 100-160 to see the answer
You've previewed enough free 100-160 questions. Unlock 100-160 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.