300-215 · Question #57
During a routine security audit, an organization's security team detects an unusual spike in network traffic originating from one of their internal servers. Upon further investigation, the team…
The correct answer is B. Disconnect the compromised server from the network. E. Review the organization's network logs for any signs of intrusion. Isolating the suspected server immediately halts any ongoing malicious communication and limits further compromise. Examining historical network logs uncovers how and when the intrusion began, guiding your next investigative steps.
Question
During a routine security audit, an organization’s security team detects an unusual spike in network traffic originating from one of their internal servers. Upon further investigation, the team discovered that the server was communicating with an external IP address known for hosting malicious content. The security team suspects that the server may have been compromised. As the incident response process begins, which two actions should be taken during the initial assessment phase of this incident? (Choose two.)
Options
- ANotify law enforcement agencies about the incident.
- BDisconnect the compromised server from the network.
- CConduct a comprehensive forensic analysis of the server hard drive.
- DInterview employees who have access to the server.
- EReview the organization's network logs for any signs of intrusion.
How the community answered
(34 responses)- A12% (4)
- B76% (26)
- C9% (3)
- D3% (1)
Explanation
Isolating the suspected server immediately halts any ongoing malicious communication and limits further compromise. Examining historical network logs uncovers how and when the intrusion began, guiding your next investigative steps.
Topics
Community Discussion
No community discussion yet for this question.