An information security manager believes that a network file server was compromised by a hacker. Which of
the following should be the FIRST action taken?

A.
Unsure that critical data on the server are backed up.

B.
Shut down the compromised server.

C.
Initiate the incident response process.

D.
Shut down the network.

Explanation:

The incident response process will determine the appropriate course of action. If the data have been corrupted by a hacker, the backup may also be corrupted. Shutting down the server is likely to destroy any forensic evidence that may exist and may be required by the investigation. Shutting down the network is a drastic action,
especially if the hacker is no longer active on the network.