Forensic Readiness and Investigation

Correct Answer: Isolate the affected server

Isolating the server prevents further harm and contamination of evidence. Other options are either reactive, impractical, or should be considered later in the investigation.

Correct Answer: Disconnect the computer from the network

When dealing with a suspected data breach, the first and most critical step is to disconnect the affected computer from the network. This action is crucial because it immediately stops any ongoing unauthorized access, prevents further data exfiltration, and halts potential spread of malware to other systems. By isolating the compromised system, you preserve the current state of evidence and prevent remote attackers from altering or destroying potential evidence. This step also protects other networked devices from potential infection. Only after the system is isolated can you safely proceed with documenting and analyzing the system's state, ensuring that the evidence remains intact and unaltered. Other steps like notifying employees or analyzing the system should only be taken after the initial containment is achieved through disconnection.

Correct Answer: Documenting every step of the evidence handling process

Maintaining a clear chain of custody means documenting every step of the evidence handling process. The other options either have no direct relevance to the chain of custody or are not in line with best practices.