Exam CS0-003 topic 1 question 170 discussion

Im choosing E because segmenting the department from the network would prevent the potential spread of malware to other parts of the network.

The first step for the incident response team should be E. Segment the entire department from the network and review each computer offline. This approach minimizes the risk of further infection and allows the team to assess the situation in a controlled and secure environment.

The network is already highly segmented. Any more segmenting will have to include an island for each machine. I would login with admin credentials and attempt to remove the malware first.

Why is it not A instead of E? The question indicates that there is already robust network segmentation, and having all devices off at the same time will hamper the organization.

Containment is priority at this point, E addresses this.

its b.

Using Copilot: The first step the incident response staff members should take when they arrive in this situation is to segment the entire department from the network and review each computer offline. Let me explain why: Segmentation and Isolation: The compromised systems should be isolated from the network to prevent further spread of the malware. By segmenting the department, you prevent the malware from affecting other parts of the network. Review Offline: Once isolated, the incident response team can review each computer offline. This allows them to analyze the malware, assess the extent of the compromise, and determine the best course of action for recovery.