Bonney's system has been compromised by a gruesome malware. What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

The correct answer is A. Turn off the infected machine. Turning off the infected machine is a common immediate response to contain a malware incident and prevent it from spreading to other systems on the network. This action halts any ongoing malicious activities by the malware, thereby limiting the potential for further damage or…

Incident Handling and Response Process

Question

Options

ATurn off the infected machine
BLeave it to the network administrators to handle
CComplaint to police in a formal way regarding the incident
DCall the legal department in the organization and inform about the incident

How the community answered

(24 responses)

A
88% (21)
B
4% (1)
C
8% (2)

Explanation

Turning off the infected machine is a common immediate response to contain a malware incident and prevent it from spreading to other systems on the network. This action halts any ongoing malicious activities by the malware, thereby limiting the potential for further damage or data exfiltration. However, it is essential to note that this step can lead to the loss of volatile data that might be useful for forensic analysis. Therefore, it is advisable only when it's critical to stop the malware immediately, and there's a strategy in place for forensic investigation that includes handling non-volatile data or when the preservation of volatile data is not possible.

Topics

#malware containment#incident containment#malware response#first response

Community Discussion

No community discussion yet for this question.

Full 212-89 Practice