Gabby suspects that an attacker has gained control of her system. Which of the following is the most appropriate action for her to take?

Question

Options

• AShut down the computer.
• BEnable strong encryption on all files on the hard disk.
• CRun anti-virus software on all disks associated with this system.
• DUnplug the computer network cable and/or disable the computer's wireless NIC.

• B
  4% (1)
• C
  4% (1)
• D
  93% (25)

Explanation

Disconnecting from the network (D) is the correct first response because it stops the attacker's active access without destroying evidence. If an attacker has live control of your system, every second they remain connected allows data exfiltration, lateral movement, or further damage - severing the connection cuts that off immediately while preserving the system state for forensic investigation.

Why the distractors are wrong:

• A (Shut down): Powering off destroys volatile memory (RAM), which may contain attacker tools, running processes, or encryption keys critical for forensics. It also doesn't address the root compromise.
• B (Enable encryption): This does nothing to stop an active attacker and could actually lock you out of your own files while the attacker still has access.
• C (Run AV): Anti-virus is reactive and slow; running it while the attacker still has network access is futile - they can disable it, reinstall malware, or continue exfiltrating data in real time.

Memory tip: Think of it like catching a burglar inside your house - you don't turn off the lights (shutdown) or lock the filing cabinet (encryption) first. You cut off their escape route and call for help (disconnect network, then investigate). The phrase "pull the plug on the network, not the power" captures the key distinction.

No community discussion yet for this question.