A Security Operations Center (SOC) receives an incident response notification on a server with an active intruder who has planted a backdoor. Initial notifications are sent and communications are established.
What MUST be considered or evaluated before performing the next step?

Question

A Security Operations Center (SOC) receives an incident response notification on a server with an active intruder who has planted a backdoor. Initial notifications are sent and communications are established.

What MUST be considered or evaluated before performing the next step?

sangilipandy Arumugam · Accepted Answer

Copying the contents of the hard drive to another storage device may damage the evidence

sangilipandy Arumugam · Answer

Notifying law enforcement is crucial before hashing the contents of the server hard drive

sangilipandy Arumugam · Answer

Identifying who executed the incident is more important than how the incident happened

sangilipandy Arumugam · Answer

Removing the server from the network may prevent catching the intruder

Question list

List of questions

Question 1

(1)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 593 - CISSP discussion

Suggested answer: D

0 comments