Certified Information Systems Security Professional CISSP · Free Practice Question Medium
Question 24
Esther is the head of IT security at a large corporation. She has recently discovered that one of the servers has been compromised and is being used as a Command and Control (C&C) server. She is responsible for determining the best course of action to take to secure the server and prevent further compromise. Which of the following actions should be taken FIRST to secure the C&C server?
- A Disconnect the server from the network
- B Run a malware scan on the server
- C Perform a forensic analysis of the server to determine the cause of the compromise
- D Patch any vulnerabilities on the server
Reveal correct answer
Correct answer: A
Explanation
The correct answer: Disconnect the server from the network: This should be the first action taken. By disconnecting the compromised server from the network, you immediately prevent any further malicious communications from or to the server. This can halt the attacker's activities and stop any potential spread of malware or exfiltration of data from the server. The incorrect answers: Perform a forensic analysis of the server to determine the cause of the compromise: This is an essential step to understand the breach's nature and extent, it should not be the immediate action. First, you want to ensure that the threat is contained by disconnecting the server. Run a malware scan on the server: It's crucial to identify and remove malicious software. However, before doing this, the server should be isolated to prevent any malware from communicating or causing more harm. Patch any vulnerabilities on the server: Patching is crucial to preventing future attacks, it's not the first action to take in this scenario. Once the server is isolated and its status assessed, vulnerabilities should be addressed before bringing the server back online.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
