Answer: Attempt to quarantine all infected hosts to limit further spread. As soon as the malware was identified, the incident response begins. The steps for incident response are: 1. Preparation - Preparing for an attack and how to respond 2. Identification - Identifying the threat 3. Containment - Containing the threat 4. Eradication - Removing the threat 5. Recovery - Recovering affected systems 6. Lessons Learned - Evaluating the incident response, see where there can be improvements for a future incident. In the scenario, the malware has already been identified, which means that we are past the Identification step. The next step would be to begin containment as to limit the amount of damage the malware can cause, so, quarantining infected hosts would be the best option here.

Quarantine to limit further spread

Quarantine.

Quarantine

When a security analyst identifies malware spreading through the corporate network and activates the Computer Security Incident Response Team (CSIRT), the immediate next step should be to attempt to quarantine all infected hosts to limit further spread of the malware. Quarantining infected hosts can help contain the malware and prevent it from infecting other systems on the network.

When a security analyst has identified malware spreading through the corporate network and activated the Computer Security Incident Response Team (CSIRT), the next step would be to attempt to quarantine all infected hosts to limit further spread. This is crucial to prevent the malware from infecting more systems and potentially causing additional damage.

The sensible next step is to isolate the malware to prevent spread. AKA quarantine the incident.

Could be C because the plan was already activated and one phase included in the IRP states that the threat must be identified and contained which means trying to avoid spreading the virus to the entire company. Then the next logical step must be to reimage the infected PCs.

B. Quarantine to limit the spread

Phases in the Incident Response Plan 1. Preparation: The organization plans out how they will respond to attack, this can involve: 2. Identification: Detecting and determining whether an incident has occurred. 3. Containment: Once a threat has been identified, the organization must limit or prevent any further damage. 4. Eradication: The removal of the threat 5. Recovery: Restoring systems affected by the incident 6. Lessons Learned: Where the organization reviews their incident response and prepare for a future attack

This question is free for interpretation again :-( A is my bet, whereas B (containment)/C (recovery) could be right, too. By activating the CSIRT his duties regarding containment and recovery could be fullfilled/handed over and the analyst goes to "lessons learnt".

Incident response cycle, step 2 identification > step 3 containment