212-82 · Question #149
You are the Lead Cybersecurity Specialist at GlobalTech, a multinational tech conglomerate renowned for its avant-garde technological solutions in the aerospace and defense sector. The…
The correct answer is B. Initiate the incident response protocol, focusing on immediate containment by isolating the. Explanation Option B is correct because initiating the incident response protocol with immediate containment is the foundational first step in any cybersecurity breach - isolating the compromised server stops the attack from spreading, preserves forensic evidence, and prevents…
Question
You are the Lead Cybersecurity Specialist at GlobalTech, a multinational tech conglomerate renowned for its avant-garde technological solutions in the aerospace and defense sector. The organization's reputation stands on the innovative technologies it pioneers, many of which are nation's top secrets. Late on a Sunday night, you are alerted about suspicious activities on a server holding the schematics and project details for a groundbreaking missile defense system. The indicators suggest a complex, multi-stage cyberattack that managed to bypass traditional security measures. Preliminary investigations reveal that the cybercrlmlnals might have used an Insider's credentials, further complicating the breach. Given the extremely sensitive nature of the data involved, a leak could have severe national security implications and irreparably tarnish the company's reputation. Considering the potential gravity and intricacies of this security incident, what immediate action should you undertake to handle this situation effectively, safeguard crucial data, and minimize potential fallout?
Options
- AInform the top executive board and legal team about the breach. Prepare a public statement to
- BInitiate the incident response protocol, focusing on immediate containment by isolating the
- CNotify federal agencies about the potential breach of national security. Work in tandem with them
- DEngage with an external specialized cybersecurity firm to conduct a parallel investigation,
How the community answered
(22 responses)- A5% (1)
- B73% (16)
- C9% (2)
- D14% (3)
Explanation
Explanation
Option B is correct because initiating the incident response protocol with immediate containment is the foundational first step in any cybersecurity breach - isolating the compromised server stops the attack from spreading, preserves forensic evidence, and prevents further data exfiltration before any other actions can be meaningfully taken. Containment must precede all other responses to limit damage.
Why the distractors are wrong:
- Option A (notifying executives/legal and issuing a public statement) is premature - you cannot responsibly communicate about a breach before you understand its scope, and a rushed public statement could cause unnecessary panic or tip off the attackers
- Option C (notifying federal agencies first) is important given the national security implications, but cannot be your immediate first action - you need containment data and confirmed facts before involving regulators
- Option D (engaging an external cybersecurity firm) is a valuable secondary step, but brings in third parties before the situation is even stabilized, which could complicate chain of custody and evidence integrity
Memory Tip: Think of a cybersecurity breach like a burst water pipe - your first instinct is to shut off the water (contain), not call the insurance company (legal), the city council (federal agencies), or a plumber service (external firm). Contain first, communicate second is the golden rule of incident response.
Topics
Community Discussion
No community discussion yet for this question.