A security analyst received an alert from a SIEM platform that one of their organization's servers with the serial number 34E93G0947LBJK60, has been compromised by a malicious actor. The analyst…

Question

Options

• ACommunicate with the attacker to negotiate the return of the exfiltrated customer data from server 34E93G0947LBJK60.
• BMeasure the impact of the data breach and assess the potential risk to the organization.
• CReport to the incident response team and initiate remediation actions to contain the attack.
• DEscalate the issue to the executive management for guidance on communication with affected customers.

• A
  5% (2)
• B
  13% (5)
• C
  72% (28)
• D
  10% (4)

Explanation

Option C is correct because once data exfiltration is confirmed, the immediate priority is containment - reporting to the incident response team and initiating remediation stops the bleeding, preserves evidence, and follows standard IR frameworks (NIST, SANS) which place "containment" before any other action.

Why the distractors are wrong:

• A is dangerous and counterproductive - negotiating with attackers is never a sanctioned IR step, validates criminal behavior, and could violate legal/regulatory policies.
• B is a valid step, but it comes after containment - measuring impact before stopping the attack allows further damage to occur.
• D is also valid eventually, but executive escalation and customer communication are downstream activities; leadership cannot act meaningfully until the attack is first contained.

Memory tip: Think of IR like a house fire - you call the fire department first (C: contain it), then assess the damage (B), then notify the homeowner/insurance (D). You never negotiate with the fire (A).

No community discussion yet for this question.