CompTIA CySA+ CS0-003 Practice Question
During the monitoring phase, an anomaly is detected in the network traffic pattern indicating potential exfiltration of sensitive data. The security analyst observes a consistent high volume of outbound traffic heading to an unusual external IP address. What should the analyst do FIRST in accordance with incident declaration and escalation practices?
Immediately disconnect the network to prevent further potential data loss without validating the incident.
Follow the organizational incident response plan to determine if the observed activity meets the criteria for incident declaration and escalate as required.
Draft an executive summary of the event to be distributed to all employees to ensure company-wide awareness.
Contact law enforcement for immediate investigation before taking any internal response measures.