A Company's Incident Response Team Is Handling a Threat That

Multiple Choice

A company's incident response team is handling a threat that was identified on the network. Security analysts have determined a web server is making multiple connections from TCP port 445 outbound to servers inside its subnet as well as at remote sites. Which of the following is the MOST appropriate next step in the incident response plan?

A) Quarantine the web server
B) Deploy virtual firewalls
C) Capture a forensic image of the memory and disk
D) Enable web server containerization