A junior help-desk technician notices that a coworker's machine is beaconing to an unusual external IP every 60 seconds. The technician suspects a compromise but is unsure how to proceed. Company policy states all suspected incidents must be reported to the security team before taking action.
What is the CORRECT first action the junior technician should take, according to incident response best practice for junior staff?
- A.Reboot the machine to clear any in-memory malware, then escalate
- B.Disconnect the network cable to stop the beaconing, then notify the security team
- C.Run a full antivirus scan and delete any flagged files, then file a report
- D.Document the observation and immediately notify the security team without modifying the system
Why D is correct
Incident response best practice requires preservation of evidence and immediate escalation. Documenting and notifying ensures the security team can perform forensic investigation with the system in its current state. Disconnecting the network cable (even though it stops beaconing) destroys volatile network evidence and may trigger malware kill switches - and the junior technician is specifically told not to act before notifying. Running antivirus and deleting files destroys forensic evidence. Rebooting clears volatile memory (RAM) containing running process data, network connections, and decryption keys - critical evidence is lost. The technician's role is to observe, document, and escalate.
Know someone studying for Network Fundamentals? Send them this one.