CompTIA SecurityX CAS-005 (V5) Practice Question

A coordinated procedure helps stop further disclosures and gather evidence for an investigation. Activating a response plan and preserving logs enables methodical containment and documentation. Notifying law enforcement might be appropriate at a later stage, based on incident severity and organizational procedure. Revoking credentials in relevant areas should be guided by evidence and access logs to avoid damaging normal operations. Shutting down affected servers might remove evidence and could delay recovery if not done systematically.