Security Operations
Question #136
Your SOC tools trigger alerts of simultaneous file modifications across several departments. What is the best immediate action to contain the situation?
A. Assume a ransomware attack and immediately shut down all servers to halt the spread.
B. Start a full system backup to ensure data recovery options are current.
C. Disconnect all network cables immediately to prevent further network propagation.
D. Conduct an in-depth analysis of the pattern to determine if the activity is malicious.
Domain Concept: Security Operations
This scenario evaluates management-level decision making in Security Operations. In CISSP exam scenarios, evaluate answers through executive governance, risk assessment, life safety, and due diligence before implementing technical controls.
💡 View the Answer & Detailed Explanation
The correct answer to this scenario-based question requires an understanding of the CISSP Managerial Mindset. Register to view our in-depth explanation and access 1100+ adaptive questions completely free.