Question

During a security event, a SOC analyst detects unusual outbound traffic from a server that hosts a customer-facing payment application. The analyst is unsure how urgently to escalate and which stakeholders to notify. Which activity, if performed FIRST, would BEST determine the appropriate escalation path and response resources?

Accepted Answer

Classify and categorize the incident based on its potential business impact and severity

Answer

Immediately isolate the server from the network to stop the outbound traffic

Answer

Notify the payment card brands and affected customers of a suspected breach

Answer

Begin capturing forensic images of the affected server for later investigation