Chapter 21: Explain appropriate incident response activities

1. The correct answer is option A. In the analysis phase, you should isolate the affected system to prevent further damage while conducting root cause analysis to understand the extent of the incident. Option B is incorrect because disconnecting the server from the network is containment and would be the right things to do, but when coupled with restoring from backups. It is incorrect as backup is part of the restore phase , it is not part of the analysis phase but recover phase. Option C is incorrect as reporting to legal authorities, if required, is done later in the incident response process. Option D is incorrect because a tabletop exercise is a paper-based preparation activity and not an immediate response to an incident.
2. The correct answer is option A. The primary objective during the Containment phase is to remove the infected critical system from the network. Option B is incorrect because eliminating malware...