Exam SY0-601 topic 1 question 721 discussion

A. Contain the impacted hosts. The incident response process on the exam has six steps— 1.preparation, 2. identification, 3. CONTAINMENT - THIS is where we are now in this example 4. eradication, 5. recovery, and 6. lessons learned.

A. Contain the impacted hosts. Containing the impacted hosts involves isolating or quarantining the affected systems from the rest of the network to prevent further spread of the malware and mitigate potential damage. Once contained, the incident response team can proceed with investigating the malware, analyzing its behavior, and determining the appropriate remediation steps. This initial containment step helps prevent the malware from spreading to other systems and compromising additional parts of the network while the investigation and response efforts are underway.

A. Contain the impacted hosts: Containment is often the first step in incident response to prevent the malware from spreading further or causing additional damage. By containing the impacted hosts, you're isolating them to prevent potential lateral movement or communication with a command and control server. The other options, while potentially valuable in certain contexts, are not the immediate first steps in this scenario