Question

A security analyst receives multiple SIEM alerts indicating suspicious lateral movement across several servers in a data center. The incident response team has confirmed the activity is malicious. Before selecting a containment approach, what is the MOST important activity the team should complete during the analysis phase?

Accepted Answer

Determine the full scope of affected systems and the extent of the compromise

Answer

Immediately disconnect all servers exhibiting suspicious activity from the network

Answer

Notify law enforcement so a criminal investigation can begin promptly

Answer

Draft the post-incident report to document lessons learned