CompTIA
MB0-001 · Question #120
An administrator has been informed that one of the systems on the corporate network has been compromised. Which of the following steps should the administrator take NEXT to initiate proper incident…
The correct answer is D. Alert the incident response team and await further instruction on procedures. See the full explanation below for the reasoning.
Question
An administrator has been informed that one of the systems on the corporate network has been compromised. Which of the following steps should the administrator take NEXT to initiate proper incident response?
Options
- ATake screen shots and copy logs from the affected machine, storing these in a secured environment.
- BUse MD5 on the system and backup the current image if the system is virtual.
- CIsolate the device and perform a device wipe.
- DAlert the incident response team and await further instruction on procedures.
How the community answered
(60 responses)- A5% (3)
- B18% (11)
- C7% (4)
- D70% (42)
Community Discussion
No community discussion yet for this question.