An incident response analyst at a large corporation is reviewing proxy log data. The analyst believes a malware infection may have occurred. Upon further review, the analyst determines the computer responsible for the suspicious network traffic is used by the Chief Executive Officer (CEO). Which of the following is the best NEXT step for the analyst to take?

Question

Quizplus · Accepted Answer

Disconnecting the CEO's workstation from the network is the best immediate step to prevent any potential spread of malware or further unauthorized access, while minimizing disruption and maintaining security.

An Incident Response Analyst at a Large Corporation Is Reviewing