Adam works as an Incident Handler for Umbrella Inc. He is informed by the senior authorities that the server of the marketing department has been affected by a malicious hacking attack. Supervisors are also claiming that some sensitive data are also stolen. Adam immediately arrived to the server room of the marketing department and identified the event as an incident. He isolated the infected network from the remaining part of the network and started preparing to image the entire system. He captures volatile data, such as running process, ram, and network connections. Which of the following steps of the incident handling process is being performed by Adam?

Question

Accepted Answer

D. Containment Containment is the phase where the incident handler isolates the affected system or network segment to prevent further spread of the attack. Capturing volatile data such as RAM, running processes, and network connections while the system is isolated is a standard containment-phase activity performed before any eradication or full imaging steps begin.

Answer

A. Recovery Recovery involves restoring systems to normal operations after eradication has been completed, which has not yet occurred.

Answer

B. Eradication Eradication involves removing the root cause of the incident such as deleting malware or patching vulnerabilities, which Adam has not yet begun.

Answer

C. Identification Identification was already completed - Adam confirmed the event as an incident before taking the actions described in the question.

Adam works as an Incident Handler for Umbrella Inc. He is informed by the senior authorities that the server of the marketing department has been affected by a malicious hacking attack. Supervisors…

Question

Options

How the community answered

Why each option

Topics

Community Discussion