The helpdesk reports increased calls from clients reporting spikes in malware infections on
their systems. Which of the following phases of incident response is MOST appropriate as a
FIRST response?
A.
Recovery
B.
Follow-up
C.
Validation
D.
Identification
E.
Eradication
F.
Containment
Q10: why not F (Containment)?
The phases are: first responder, identification, isolation, escalation, notification, mitigation, loss control data breach and lessons learned.
Because how can you properly contain something you’ve yet to identify ?