Which of the following is the BEST course of action when it is discovered that a server has been infected by malware?

The correct answer is C. Disconnect the infected server from the network. The immediate priority upon discovering an active malware infection is containment - preventing the malware from spreading laterally to other systems or communicating with external command-and-control (C2) infrastructure. Disconnecting the server from the network achieves both…

Submitted by saadiq_pk· Apr 18, 2026Information Security Incident Management

Question

Which of the following is the BEST course of action when it is discovered that a server has been infected by malware?

Options

ARedirect the traffic of the infected server using diverse routing.
BActivate an anti-malware program on the server.
CDisconnect the infected server from the network.
DRemove power to the infected server.

How the community answered

(59 responses)

A
2% (1)
B
10% (6)
C
83% (49)
D
5% (3)

Explanation

The immediate priority upon discovering an active malware infection is containment - preventing the malware from spreading laterally to other systems or communicating with external command-and-control (C2) infrastructure. Disconnecting the server from the network achieves both goals instantly while preserving the system for forensic investigation. Option A (diverse routing) redirects traffic but leaves the infected system connected and able to spread. Option B (running anti-malware) risks alerting the malware, destroying forensic artifacts, or failing to remove sophisticated threats. Option D (removing power) destroys volatile memory (RAM) that may contain critical forensic evidence such as encryption keys or active malware processes, and risks filesystem corruption.

Topics

#Incident Response#Malware#Containment#Network Isolation

Community Discussion

No community discussion yet for this question.

Full CISM Practice