Free CompTIA CySA+ CS0-003 Practice Question
During an active incident response, an analyst has identified a server that has been compromised by malware. The server is part of a clustered database that includes real-time replication to other nodes. To prevent the spread of the malware, which of the following is the BEST course of action to isolate the compromised server while maintaining the highest degree of operational availability?
Disconnect the affected server's network connection.
Shut down the affected server immediately.
Start re-imaging the affected server to remove the malware.
Implement a rule on the firewall to block all traffic from the affected server.
This question's topic:
CompTIA CySA+ CS0-003 /
Incident Response and Management
SAVE $49