Exam 350-201 topic 1 question 22 discussion

D is the correct answer, the first step is analysis before containment and B says to isolate critical hosts not infected hosts.

Once you identified true positive alerts, the first step is to isolate victim machines from the network, aka containment.

Based on best practices for incident response, the first action for the incident response team should be to isolate critical hosts from the network. This is important to prevent the malware from spreading further and causing additional damage. Isolating critical hosts can involve disabling network connections, shutting down affected systems, or physically disconnecting the systems from the network. This step should be taken as soon as possible to limit the impact of the malware and prevent it from spreading to other systems or areas of the network. Once critical hosts have been isolated, the incident response team can then move on to other actions, such as assessing the network for unexpected behavior, patching detected vulnerabilities, or performing analysis based on established risk factors. Therefore, the correct answer is B. Isolate critical hosts from the network.

Isolate critical hosts from the network

2. Identification—monitor IT systems and detect deviations from normal operations, and see if they represent actual security incidents. When an incident is discovered, collect additional evidence, establish its type and severity, and document everything.

For me is D Perform analysis based on the established risk factors But im not totally sure

B is correct answer