Câu 10: CS0-003: CompTIA CySA+ (CS0-003)

During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened. Which of the following actions should the analyst take first?

1. A. Clone the virtual server for forensic analysis — đáp án hiện tại
2. B. Log m to the affected server and begin analysis of the logs
3. C. Restore from the last known-good backup to confirm there was no loss of connectivity
4. D. Shut down the affected server immediately