In a large financial institution, a cybersecurity analyst is responsible for monitoring network traffic patterns for any signs of cyberattacks. During routine analysis, the analyst identifies this…

Question

Options

• AConduct a detailed analysis of the compromised server to identify the attack vector and close any vulnerabilities.
• BShare the incident findings with a cybersecurity threat intelligence-sharing consortium for collaborative threat analysis.
• CImmediately disconnect the affected internal server from the network to prevent further data exfiltration.
• DImplement strict access controls and monitor privileged user accounts for any suspicious activities.

• A
  58% (19)
• B
  24% (8)
• C
  6% (2)
• D
  12% (4)

Explanation

Option A is the most complete remediation recommendation because it targets the root cause: without analyzing the compromised server to identify the attack vector, any response leaves the underlying vulnerability open to re-exploitation. Remediation, by definition, requires understanding how the breach occurred so that specific vulnerabilities can be patched and the attack path closed permanently.

Option C (disconnecting the server) is a containment action - it's a valid immediate response step, but it belongs to the isolation phase, not remediation; unplugging a server doesn't fix the vulnerability that allowed the breach. Option D (access controls and monitoring) is a hardening/preventive measure for future protection but does not address the existing compromise or close the door the attacker used. Option B (sharing with a threat intelligence consortium) is a collaborative intelligence activity that benefits the wider community but provides no direct remediation to the institution currently under attack.

Memory tip: Anchor the word "remediation" to "root cause removal" - if an answer only isolates, prevents, or informs, it's not remediating. The only answer that involves finding and fixing the hole is A.

No community discussion yet for this question.