You have identified a virus that has quickly spread throughout your organization through fileshares. You have isolated the server that was the source of the infection, and you're working with your…

Question

Options

• AConfirm the call is virus-related and log the information into the ticketing system
• BMake a best attempt to locate and remove remnants of the virus from user systems
• CBrief users of the current status of the situation, based on internal memos
• DRun Windows Update to eliminate potential vulnerabilities on infected systems

• A
  83% (30)
• B
  3% (1)
• C
  3% (1)
• D
  11% (4)

Explanation

You're still within the containment phase of this incident. The virus is not currently spreading, but you're still gathering information on the virus. The service desk can best assist you by gathering information from the users and logging it into a ticketing system. Once you determine the characteristics of the virus, you can use that information to further contain or eradicate the virus on your network. The service desk may be helpful for briefing users, but not in place of gathering information, and that communication should be specifically geared toward users, not generated from memos to the IS department (which may include information that is unnecessary or even harmful for users to know). Removing remnants of the virus off user systems could hurt forensic data, break user systems, or even impede later efforts to eradicate the virus. Running updates are actions that should be taken during the recovery phase, and may hinder incident response (by taking too much time with users or eliminating forensic data).

No community discussion yet for this question.