A security operations center (SOC) indicated that a system has been infected by malware and the IT department promptly moved the infected system to an isolated network. Which of the following should…

The correct answer is D. Determine the impact of the incident. After isolating the infected system, the next step for the information security manager is to assess the impact of the incident. This involves evaluating the scope of the malware infection, determining affected systems or data, and understanding potential business or…

Submitted by rania.sa· Apr 18, 2026Information Security Incident Management

Question

A security operations center (SOC) indicated that a system has been infected by malware and the IT department promptly moved the infected system to an isolated network. Which of the following should the information security manager do NEXT?

Options

AEnsure antivirus signatures are updated.
BEnsure the system is disconnected from the network.
CDetermine the sequence of events leading to the incident.
DDetermine the impact of the incident

How the community answered

(21 responses)

A
5% (1)
B
5% (1)
C
14% (3)
D
76% (16)

Explanation

After isolating the infected system, the next step for the information security manager is to assess the impact of the incident. This involves evaluating the scope of the malware infection, determining affected systems or data, and understanding potential business or operational consequences. This assessment is crucial for prioritizing response efforts and implementing appropriate remediation actions.

Topics

#Incident Response#Malware#Impact Assessment#Containment

Community Discussion

No community discussion yet for this question.

Full CISM Practice