Câu 120: CS0-003: CompTIA CySA+ (CS0-003)

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

1. A. Take a snapshot of the compromised server and verify its integrity — đáp án hiện tại
2. B. Restore the affected server to remove any malware
3. C. Contact the appropriate government agency to investigate
4. D. Research the malware strain to perform attribution