Câu 189: CS0-003: CompTIA CySA+ (CS0-003)

Two employees in the finance department installed a freeware application that contained embedded malware. The network is robustly segmented based on areas of responsibility. These computers had critical sensitive information stored locally that needs to be recovered. The department manager advised all department employees to turn off their computers until the security team could be contacted about the issue. Which of the following is the first step the incident response staff members should take when they arrive?

1. A. Turn on all systems, scan for infection, and back up data to a USB storage device.
2. B. Identify and remove the software installed on the impacted systems in the department.
3. C. Explain that malware cannot truly be removed and then reimage the devices.
4. D. Log on to the impacted systems with an administrator account that has privileges to perform backups.
5. E. Segment the entire department from the network and review each computer offline. — đáp án hiện tại