A security analyst receives an alert that highly sensitive information has left the company's network. Upon investigation, the analyst discovers an outside IP range has had connections from three servers more than 100 times in the past month. The affected servers are virtual machines. Which of the following is the BEST course of action?
A. Shut down the servers as soon as possible, move them to a clean environment, restart, run a vulnerability scanner to find weaknesses, determine the root cause, remediate, and report.
B. Report the data exfiltration to management, take the affected servers offline, conduct an antivirus scan, remediate all threats found, and return the servers to service.
C. Disconnect the affected servers from the network, use the virtual machine console to access the systems, determine which information has left the network, find the security weakness, and remediate.
D. Determine if any other servers have been affected, snapshot any servers found, determine the vector that was used to allow the data exfiltration, fix any vulnerabilities, remediate, and report.
Answer: A. Shut down the servers as soon as possible, move them to a clean environment, restart, run a vulnerability scanner to find weaknesses, determine the root cause, remediate, and report.
You might also like to view...
The ________ function isolates a specific portion of a date, such as the day, month, or year, in a date field
A) DateArithmetic B) DateDiff C) Date D) DatePart
?_________ is a method of organization in which data sources are interconnected through a series of links that users activate to jump from one data source to another.
Fill in the blank(s) with the appropriate word(s).