Examkin

Soru

Zorluk: OrtaIncident Response and Chain of Custody

An IT support technician discovers a finance department workstation that is actively transmitting unauthorized traffic to an external IP address. To contain the threat while preserving digital evidence according to standard incident response procedures, which TWO actions should the technician take immediately? (Select TWO.)

  1. Disconnect the physical network cable and disable wireless connectivity on the workstation.Cevap
  2. Report the incident immediately to the designated security officer or incident response team.Cevap
  3. C
    Perform a hard shutdown of the workstation by holding down the physical power button.
  4. D
    Log into the user account to browse files and determine which specific sensitive documents were accessed.

Cevap

The technician should disconnect the physical network cable and disable wireless connectivity, and report the incident immediately to the designated security officer or incident response team.
When responding to an active incident, the first responder's immediate priorities are containment and reporting. Disconnecting network connections (both wired and wireless) stops active data exfiltration and prevents malware from spreading across the local network without powering off the machine. Promptly reporting the event to the designated security team ensures proper incident management escalation while keeping system state preserved for forensic investigators.

Adım Adım Çözüm

1
Isolate the compromised workstation from all network connections.
Network communication and data exfiltration are stopped immediately without altering volatile memory state.
Isolation stops ongoing attack activity and prevents lateral movement across the network.
2
Escalate and report the incident following established organizational channels.
The incident response team is notified and can initiate official incident management procedures.
First responders must notify authorized security personnel promptly to coordinate forensic acquisition and remediation.

Anahtar Kavram

First Responder Incident Isolation and Notification
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru