12
answers
1
watching
413
views

While investigating a security event, an analyst finds evidence that a user opened an email attachment from an unknown source. Shortly after the user opened the attachment, a group of servers experienced a large amount of network and resource activity. Upon investigating the servers, the analyst discovers the servers were encrypted by ransomware that is demanding payment within 48 hours or all data will be destroyed. The company has no response plans for ransomware.
Which of the following is the NEXT step the analyst should take after reporting the incident to the management team?

  • A. Pay the ransom within 48 hours.
  • B. Isolate the servers to prevent the spread.
  • C. Notify law enforcement.
  • D. Request that the affected servers be restored immediately.

Note : one source is saying B and other source is saying C ... i am confused . Please help to guide with the correct information 

For unlimited access to Homework Help, a Homework+ subscription is required.

Unlock all answers

Get 1 free homework help answer.
Already have an account? Log in
Already have an account? Log in
Already have an account? Log in
Already have an account? Log in
Already have an account? Log in
Already have an account? Log in
Already have an account? Log in
Already have an account? Log in
Already have an account? Log in
Avatar image
Read by 1 person
Already have an account? Log in
Avatar image
Read by 1 person
Already have an account? Log in
Avatar image
Read by 2 people
Already have an account? Log in

Related questions

Weekly leaderboard

Start filling in the gaps now
Log in