An information security analyst discovered a virtual machine server was compromised by an attacker. Which of the following should be the FIRST step to confirm and respond to the incident?
A) Pause the virtual machine,
B) Shut down the virtual machine.
C) Take a snapshot of the virtual machine.
D) Remove the NIC from the virtual machine.

Question

Quizplus · Accepted Answer

Taking a snapshot of the virtual machine is the first step to preserve the current state for forensic analysis and investigation before making any changes or taking further actions.

An Information Security Analyst Discovered a Virtual Machine Server Was