An incident involving a workstation that is potentially infected with a virus has occurred. The workstation may have sent confidential data to an unknown internet server. Which of the following should a security analyst do FIRST?

Last Updated on August 14, 2021 by Admin

An incident involving a workstation that is potentially infected with a virus has occurred. The workstation may have sent confidential data to an unknown internet server.

Which of the following should a security analyst do FIRST?

• Make a copy of everything in memory on the workstation.
• Turn off the workstation.
• Consult information security policy.
• Run a virus scan.