A workstation is exhibiting symptoms of malware and the network security analyst has decided to
remove the system from the network. This represents which of the following stages of the Incident
Handling Response?
A.
Plan of action
B.
Mitigation
C.
Lesson Learned
D.
Recovery
A->plan of action
After identifying an incident, personnel attempt to contain or isolate the
problem. This is often as simple as disconnecting a computer from a
network. Reviewing lessons learned allows personnel to analyze the incident and the response with a goal of preventing a future occurrence.
4
0