An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT…

The correct answer is A. Take a snapshot of the compromised server and verify its integrity. The next action that the CSIRT should conduct after isolating the compromised server from the network is to take a snapshot of the compromised server and verify its integrity. Taking a snapshot of the compromised server involves creating an exact copy or image of the server's…

Submitted by fatima_kr· Mar 6, 2026Security and Compliance

Question

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

Options

ATake a snapshot of the compromised server and verify its integrity
BRestore the affected server to remove any malware
CContact the appropriate government agency to investigate
DResearch the malware strain to perform attribution

How the community answered

(43 responses)

A
77% (33)
B
7% (3)
C
2% (1)
D
14% (6)

Explanation

The next action that the CSIRT should conduct after isolating the compromised server from the network is to take a snapshot of the compromised server and verify its integrity. Taking a snapshot of the compromised server involves creating an exact copy or image of the server's data and state at a specific point in time. Verifying its integrity involves ensuring that the snapshot has not been altered, corrupted, or tampered with during or after its creation. Taking a snapshot and verifying its integrity can help preserve and protect any evidence or information related to the incident, as well as prevent any tampering, contamination, or destruction of evidence.

Topics

#CSIRT#Incident response#Forensics#Evidence preservation#Virtual server compromise

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice