A web server is attacked and compromised. Which of the following should be performed FIRST to
handle the incident?

A.
Dump the volatile storage data to a disk.

B.
Run the server in a fail-safe mode.

C.
Disconnect the web server from the network.

D.
Shut down the web server.

Explanation:
The first action is to disconnect the web server from the network to contain the damage and prevent
more actions by the attacker. Dumping the volatile storage data to a disk may be used at the
investigation stage but does not contain an attack in progress. To run the server in a fail-safe mode,
the server needs to be shut down. Shutting down the server could potentially erase information that
might be needed for a forensic investigation or to develop a strategy to prevent future similar attacks.