A company's incident response team is handling a threat that was identified on the network. Security analysts have determined a web server is making multiple connections from TCP port 445 outbound to servers inside its subnet as well as at remote sites. Which of the following is the MOST appropriate next step in the incident response plan?
A) Quarantine the web server
B) Deploy virtual firewalls
C) Capture a forensic image of the memory and disk
D) Enable web server containerization

Question

Quizplus · Accepted Answer

Quarantining the web server is the most appropriate next step to prevent further spread of the threat and to contain the incident while further analysis and remediation are conducted.

A Company's Incident Response Team Is Handling a Threat That