CompTIA Security+ SY0-701 Practice Question

Isolating the server by placing it in a quarantine network is the most effective immediate action to prevent the propagation of any potentially malicious activity associated with the detected behavior. This preserves the ability to conduct a forensic investigation, while patching might remove important evidence and does not stop ongoing exploitation. Reviewing security logs is an important subsequent step to gather more information about the incident but does not halt current attack vectors. Intensifying surveillance does not directly mitigate an ongoing issue and could delay critical response time.