A computer emergency response team is called at midnight to investigate a case in which a mail server was restarted. After an initial investigation, it was discovered that email is being exfiltrated through an active connection. Which of the following is the NEXT step the team should take?

Question

Quizplus · Accepted Answer

The first step in responding to a computer emergency is to identify the source of the active connection. This will help the team to determine the extent of the breach and to take appropriate action to contain the damage.

A Computer Emergency Response Team Is Called at Midnight to Investigate