Cyber Security Interview Questions and Answers › Cyber Security
A server is being hacked right now. What do you do first?
Containment means stopping the spread. Evidence is the data that shows what happened. Turning the server off wipes memory (RAM), which may hold the attacker's tools. Panic moves can destroy evidence or let the attacker spread.
Read card text
What this card says
Containment means stopping the spread. Evidence is the data that shows what happened. Turning the server off wipes memory (RAM), which may hold the attacker's tools. Panic moves can destroy evidence or let the attacker spread.
Learn more in the lesson: 31.6 The Incident Response Lifecycle