You work as the security administrator at Certpaper .com. You have become aware of a hacker
accessing confidential company data from over the network.
Which of the following actions should you perform? Choose all correct answers.

A.
Detach the network cable from the server to prevent the hacker from accessing more data.

B.
Prevent members of the organization from entering the server room.

C.
Shut down the server to prevent the hacker from accessing more data.

D.
Prevent members of the incident response team from entering the server room.

Explanation:

Answer : B is correct to stop anyone from corrupting the evidence.