Incident Response

Correct Answer: Activate containment and remediation measures

The best course of action during an ongoing cyber attack originating from spear-phishing emails is to activate containment and remediation measures. This involves steps such as isolating affected systems, resetting compromised credentials, and restoring systems from clean backups. Sending an email to employees about the attack does not directly mitigate the current threat. Installing anti-virus software is a preventive measure but does not address the active incident. Blocking email server access entirely would be too disruptive to normal business operations. Therefore, activating containment and remediation is the most appropriate incident response for the root cause identified.

Correct Answer: Isolate the affected computer

The initial action to take when suspecting a malware infection on a computer is to isolate the affected system from the network. This prevents the potential spread of malware to other devices. Running a malware scan without first isolating the system could allow the malware to propagate further. Reinstalling the operating system is a drastic step that should only be considered after attempting to remove the malware through scanning and other mitigation techniques. Simply ignoring the issue is not a valid response, as it leaves the system and potentially the network vulnerable to further compromise.

Correct Answer: Capture and analyze the file

The best course of action when finding a suspicious file during a network audit is to 'Capture and analyze the file'. This is done to understand the function, source and potential impact of the file before taking action. 'Deleting the file immediately' is not the best action, as this could possibly cause more damage, or lose potential evidence. 'Ignoring the file and continuing the audit' is also not a correct approach as the file might pose a serious security risk. 'Notifying all employees about the file' might cause unnecessary panic and lead to uncoordinated responses, and should only be done as part of a broader incident response, after analysis.