Question

During an active intrusion, an analyst discovers that a compromised server is actively exfiltrating data to an external IP. Legal has stated they intend to pursue prosecution and require forensically sound evidence. Management is pressuring the team to stop the data loss immediately. What is the BEST containment action for the analyst to take?

Accepted Answer

Isolate the server from the network while keeping it running, and capture volatile memory before further action

Answer

Power off the server immediately to halt the exfiltration and preserve the disk in its exact state

Answer

Leave the server fully connected and continue monitoring to gather more evidence of attacker behavior

Answer

Re-image the server from a known-good backup to restore service as quickly as possible