Exam CFR-310 topic 1 question 77 discussion

C. Isolate devices from the network This is the first priority to contain the malware and prevent it from spreading to other systems. Incorrect Responses: A. Make an incident response plan Important, but should already be in place before incidents. Not a first step during an active infection. B. Prepare incident response tools Necessary, but preparing tools during the incident wastes time. They should be ready beforehand. D. Capture network traffic for analysis Useful for investigation, but analysis comes after containment to avoid further spreading of malware.