nerdexam
EC-Council

312-50V10 · Question #367

An IT security engineer notices that the company's web server is currently being hacked. What should the engineer do next?

The correct answer is C. Record as much information as possible from the attack.. During an active security incident, the priority is evidence collection to support later analysis and response - not immediate disruptive action.

Information Security and Ethical Hacking Fundamentals

Question

An IT security engineer notices that the company's web server is currently being hacked. What should the engineer do next?

Options

  • AUnplug the network connection on the company's web server.
  • BDetermine the origin of the attack and launch a counterattack.
  • CRecord as much information as possible from the attack.
  • DPerform a system restart on the company's web server.

How the community answered

(52 responses)
  • A
    4% (2)
  • B
    15% (8)
  • C
    75% (39)
  • D
    6% (3)

Why each option

During an active security incident, the priority is evidence collection to support later analysis and response - not immediate disruptive action.

AUnplug the network connection on the company's web server.

Unplugging the network connection immediately destroys volatile memory artifacts and active connection data that are essential for forensic investigation.

BDetermine the origin of the attack and launch a counterattack.

Launching a counterattack is illegal under laws such as the Computer Fraud and Abuse Act and violates ethical incident response procedures.

CRecord as much information as possible from the attack.Correct

Recording as much information as possible preserves volatile evidence such as attacker IP addresses, payloads, timestamps, and affected systems. This data is critical for forensic analysis, legal proceedings, and post-incident reporting. Incident response best practices (NIST SP 800-61) emphasize detection and analysis before containment to avoid destroying evidence.

DPerform a system restart on the company's web server.

Performing a system restart wipes volatile memory (RAM) containing active process data and attacker artifacts, permanently destroying critical forensic evidence.

Concept tested: Incident response evidence preservation priority

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#incident response#evidence collection#web server attack#forensics

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice