CISA Question 196

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B4

  If we shut them down, there will be no evidence so quarantine is the best answer here

• 1

  https://amtrustfinancial.com/blog/insurance-products/what-to-do-after-a-data-breach-or-cyber-attack#:~:text=Contain%20the%20Cybersecurity%20Breach&text=The%20first%20step%20you%20should,won't%20also%20be%20infected. The first step you should take after a data breach is to determine which servers have been compromised and contain them as quickly as possible to ensure that other servers or devices won't also be infected.

• Chose B2

  B for sure