Free CompTIA CySA+ CS0-003 Practice Question
During an active incident response, your team has identified a breach within one of the company's critical servers. After initiating the containment phase, what is the next key action to perform to accurately define the scope of the incident?
Start re-imaging all compromised systems to ensure no remnants of the breach remain.
Immediately reset all user credentials within the organization to preclude further unauthorized access.
Initiate a digital forensics analysis on the directly affected server.
Analyze the extent of the compromise to understand the full impact across the network.
This question's topic:
CompTIA CySA+ CS0-003 /
Incident Response and Management
SAVE $49