A Security Is Responding to an Incident on a Web

question 56

Multiple Choice

A security is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS. Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise?

• A) Run an anti-malware scan on the system to detect and eradicate the current threat
• B) Start a network capture on the system to look into the DNS requests to validate command and control traffic
• C) Shut down the system to prevent further degradation of the company network
• D) Reimage the machine to remove the threat completely and get back to a normal running state
• E) Isolate the system on the network to ensure it cannot access other systems while evaluation is underway

---

Definitions:

Volunteers

Individuals who freely offer to take part in an activity or to perform a service.

Participants

Individuals who take part in a study or research project.

Registered

Officially recorded and recognized by authorities or organizations.

Attack Rate

is the percentage of an at-risk population that contracts a disease during a specified time period, often used in the context of an outbreak.