Exam CV0-003 topic 1 question 239 discussion

Actual exam question from CompTIA's CV0-003

Question #: 239
Topic #: 1

During a security incident, an IaaS compute instance is detected to send traffic to a host related to cryptocurrency mining. The security analyst handling the incident determines the scope of the incident is limited to that particular instance. Which of the following should the security analyst do NEXT?

A. Isolate the instance from the network into quarantine
B. Perform a memory acquisition in the affected instance
C. Create a snapshot of the volumes attached to the instance
D. Replace the instance with another from the baseline

Show Suggested Answer

Suggested Answer: A 🗳️

by TheGinjaNinja at Jan. 17, 2023, 9:03 p.m.

Comments

Submit Cancel

Pongsathorn

10 months, 4 weeks ago

Selected Answer: A

When a security incident is detected on an IaaS compute instance, and it's determined that the scope is limited to that particular instance, one of the immediate actions to take is to **isolate the instance from the network into quarantine**. This prevents any further potentially malicious activity from occurring and helps contain the incident. So, the correct answer is: A. Isolate the instance from the network into quarantine.

upvoted 2 times

...