Câu 106: CS0-002: CompTIA CySA+ Certification Exam (CS0-002)

The SOC has received reports of slowness across all workstation network segments. The currently installed antivirus has not detected anything, but a different anti-malware product was just downloaded and has revealed a worm is spreading. Which of the following should be the NEXT step in this incident response?

1. A. Send a sample of the malware to the antivirus vendor and request urgent signature creation.
2. B. Begin deploying the new anti-malware on all uninfected systems.
3. C. Enable an ACL on all VLANs to contain each segment.
4. D. Compile a list of IoCs so the IPS can be updated to halt the spread. — đáp án hiện tại