A systems administrator is reviewing the logs from a company's IDS and notices a large amount of outgoing traffic from a particular server. The administrator then runs a scan on the server, which dete

The correct answer is B. Disconnect the server from the network.. The first step in any incident response procedure is to contain the incident and prevent it from spreading or causing more damage. In this scenario, the systems administrator is reviewing the logs from a company's IDS and notices a large amount of outgoing traffic from a particul

Security

Question

A systems administrator is reviewing the logs from a company's IDS and notices a large amount of outgoing traffic from a particular server. The administrator then runs a scan on the server, which detects malware that cannot be removed. Which of the following should the administrator do first?

Options

ADetermine the root cause.
BDisconnect the server from the network.
CPerform a more intrusive scan.
DRestore the server from a backup.

How the community answered

(26 responses)

A
4% (1)
B
73% (19)
C
15% (4)
D
8% (2)

Explanation

The first step in any incident response procedure is to contain the incident and prevent it from spreading or causing more damage. In this scenario, the systems administrator is reviewing the logs from a company's IDS and notices a large amount of outgoing traffic from a particular server. The administrator then runs a scan on the server, which detects malware that cannot be removed. This indicates that the server is compromised and may be sending malicious or sensitive data to an external source. Therefore, the best thing to do first is to disconnect the server from the network, which will isolate it from the rest of the system and stop the data

Topics

#incident response#malware#network isolation#IDS

Community Discussion

No community discussion yet for this question.

Full CV0-003 Practice