CompTIA CySA+ CS0-003 Practice Question

The correct answer is to disconnect the device from the network. This action immediately stops the potential for the compromised device to communicate with attackers or other systems on the network, helping to prevent lateral movement and further compromise. It is typically the first immediate step taken to isolate an infected system. Physically removing the device could cause unnecessary service interruptions and potentially lead to loss of volatile data that is necessary for analysis. Powering off the device might also result in the loss of valuable forensic data. Enabling the device firewall does not guarantee that the device is isolated from the network, and malware or attackers may have already disabled or created rules to bypass the firewall.