Question

A SOC analyst confirms that an organization's public marketing website has been defaced with attacker-controlled content served from the production web server. The incident response playbook for website defacement has already completed identification and initial triage. According to a standard incident response workflow, which action should the analyst take NEXT before restoring the site from a clean backup?

Accepted Answer

Take a forensic image of the compromised web server and isolate it from the network to preserve evidence and stop the attacker's access

Answer

Immediately overwrite the defaced files with the latest backup to minimize the public exposure window

Answer

Publish a customer-facing breach notification to satisfy compliance obligations

Answer

Update the WAF signatures and close the incident ticket as resolved