Which of the following steps should the security analyst take?

A security analyst confirms a zero-day vulnerability was exploited by hackers who gained access to confidential customer data and installed ransomware on the server.

Which of the following steps should the security analyst take? (Select two).
A . Contact the customers to inform them about the data breach.
B . Contact the hackers to negotiate payment lo unlock the server.
C . Send a global communication to inform all impacted users.
D . Inform the management and legal teams about the data breach
E . Delete confidential data used on other servers that might be compromised.
F . Modify the firewall rules to block the IP addresses and update the ports.

View Answer

Answer: A, D

Explanation:

After a zero-day exploit resulting in a data breach and ransomware installation, it is critical to inform affected customers about the breach and the potential impact on their data. Additionally, the management and legal teams should be notified to handle the situation in compliance with regulatory requirements and to coordinate an appropriate response.

Reference: Handling security incidents and communication strategies after a data breach are crucial elements of the governance and risk compliance domains in CompTIA Cloud+.