Incident Response Team

Correct Answer: Isolate the affected systems from the rest of the network.

To prevent further spread of the malware, isolating the compromised systems from the network is the most appropriate measure in the containment phase. This ensures that the malware will not compromise other systems.

Correct Answer: Review the timeline of events for procedural adherence

After a DDoS attack, one of the most valuable actions the Incident Response Team can take is to review the sequence and timing of the events that occurred during the attack. This step involves examining how the incident unfolded and assessing the effectiveness of the response based on established procedures. By reviewing the timeline for procedural adherence, the team can identify what worked, what didn't, and what can be improved for future incident responses. This review facilitates an understanding of the gaps in the current response plan, and allows the team to make necessary adjustments to their incident response strategy. Creating a new company policy mandating increased bandwidth may not be the most cost-effective or strategic approach to mitigate DDoS attacks. It's akin to applying a bandage without assessing the actual injury. Moreover, increased bandwidth may not be sufficient to prevent future DDoS attacks. Conducting a complete overhaul of the current firewall settings is a reactive measure that doesn't necessarily align with what was learned from the attack. It may not address actual vulnerabilities or inefficiencies in responding to the attack. Implementing stronger encryption on all company communications will not directly prevent DDoS attacks, as these attacks typically target the availability of resources rather than trying to break encryption. While encryption is an important aspect of security, it does not address the specific challenges posed by DDoS attacks.

Correct Answer: Begin documenting the incident and gather any relevant logs.

The appropriate first step in investigating a potential incident is to begin documenting the situation and gather any relevant logs. This provides a structured approach and helps in understanding the extent of the issue and identifying the root cause.