Q67
Single choice
You have responded to the breach of an internal file server that contains highly confidential strategic information. The attacker compromised the server and created a local administrator. The compromise was discovered quickly, and the network cable was disconnected from the server.
Management has decided that they do not want to risk any bad publicity and will not seek prosecution of the attacker.
IT management will allow you to rebuild the server over the weekend. Until then, you create a plan to lock the administrator account, block RDP traffic with a firewall rule, and create email alerts on network traffic and from the affected server.
What phase of the incident response process is addressed by your plan?