An Engineer Detects an Intrusion Event Inside an Organization's Network

Multiple Choice

An engineer detects an intrusion event inside an organization's network and becomes aware that files that contain personal data have been accessed. Which action must be taken to contain this attack?

A) Disconnect the affected server from the network.
B) Analyze the source.
C) Access the affected server to confirm compromised files are encrypted.
D) Determine the attack surface.