CISSP Practice Question (Security Operations - Hard):

During a routine security audit, your organization's security team discovered suspicious network traffic originating from a specific internal host to an external IP address known for malicious activities. Further investigation revealed potential data exfiltration. You have been tasked with initiating an incident response and digital forensics investigation. Which of the following steps should be prioritized in this scenario?

Options:

A. Immediately isolate the internal host from the network to contain the incident.

B. Deploy a network intrusion detection system (NIDS) to monitor the suspicious host's traffic.

C. Obtain a memory dump of the suspicious host for volatile data analysis.

D. Shut down the network firewall to prevent further data exfiltration.

7 comments