Question

During a confirmed intrusion, an attacker has established a foothold on a single server in a segmented DMZ but has not yet moved laterally. The incident response team is under pressure from operations to keep the customer-facing application online. The information security manager must decide on a containment strategy. Which factor should MOST influence the choice between immediate isolation and delayed containment?

Accepted Answer

The balance between preserving business operations and limiting the risk of further compromise or evidence loss

Answer

The preference of the operations team to avoid any application downtime

Answer

The amount of disk space available for capturing forensic images

Answer

The time remaining before the next scheduled vulnerability scan