SY0-701 · Question #289
A cybersecurity incident response team at a large company receives notification that malware is present on several corporate desktops No known Indicators of compromise have been found on the…
The correct answer is A. Contain the Impacted hosts. The first step in responding to a cybersecurity incident, particularly when malware is detected, is to contain the impacted hosts. This action prevents the spread of malware to other parts of the network, limiting the potential damage while further investigation and remediation…
Question
A cybersecurity incident response team at a large company receives notification that malware is present on several corporate desktops No known Indicators of compromise have been found on the network. Which of the following should the team do first to secure the environment?
Options
- AContain the Impacted hosts
- BAdd the malware to the application blocklist.
- CSegment the core database server.
- DImplement firewall rules to block outbound beaconing
How the community answered
(30 responses)- A63% (19)
- B13% (4)
- C7% (2)
- D17% (5)
Explanation
The first step in responding to a cybersecurity incident, particularly when malware is detected, is to contain the impacted hosts. This action prevents the spread of malware to other parts of the network, limiting the potential damage while further investigation and remediation actions are
Community Discussion
No community discussion yet for this question.