— Exhibit –-

— Exhibit —
Please refer to the attached incident response procedure. Which of the following would Joe, an
administrator, do NEXT after discovering one of his critical servers has been breached?

A.
Take a copy of the machines, including memory

B.
Hash an image of the machine and isolate it from the network

C.
Notify his supervisor or next available manager in the chain of command

D.
Immediately start to restore backups for the systems

Explanation: