The engineer discovered a security breach, and upon further analysis, discovered a malware presence on several assets. According to the incident response workflow, which steps should be taken to…

Question

Options

• ADetermine where the breach started, stop the spread, and devise a plan to prevent it from reoccurring.
• BIdentify malware and assets affected, clean the malware, and maintain a constructive report
• CIdentify the types of backups in place and discuss the backup and restoration plan with management.
• DDetermine if the affected assets were patched recently and which patches were applied.

• A
  68% (13)
• B
  11% (2)
• C
  5% (1)
• D
  16% (3)

Explanation

Option A correctly follows the incident response containment workflow because addressing a breach requires three logical steps: tracing the origin of the attack (so you know what to contain), stopping lateral spread to other assets, and planning for eradication and prevention - all of which are expected during the containment and post-containment phases.

Option B is wrong because it jumps to eradication (cleaning malware) before containing the threat - this risks allowing the malware to spread further while you're busy cleaning already-infected systems. Option C belongs in the recovery phase, not containment - discussing backups and restoration is premature when the threat is still active. Option D is a root cause / lessons-learned activity that informs future patching strategy but does nothing to stop an ongoing breach.

Memory tip: Think of incident containment like a fire - you first find where it started, then smother the flames before they spread, then figure out how to fireproof the building. "Source → Spread → Safeguard" maps directly to option A's three steps.

No community discussion yet for this question.