A security analyst notices anomalous activity coming from several workstations in the organizations. Upon identifying and containing the issue, which of the following should the security analyst do NEXT?
A) Document and lock the workstations in a secure area to establish chain of custody
B) Notify the IT department that the workstations are to be reimaged and the data restored for reuse
C) Notify the IT department that the workstations may be reconnected to the network for the users to continue working
D) Document findings and processes in the after-action and lessons learned report

Question

Quizplus · Accepted Answer

After identifying and containing the issue, the next step is to document findings and processes in an after-action and lessons learned report to ensure proper documentation and to improve future incident response.

A Security Analyst Notices Anomalous Activity Coming from Several Workstations