Incident response · Question 11 of 12

The SOC notices that an attacker has been on the network for days via a compromised admin account and has placed several backdoors. Why can it make sense not to clean individual systems immediately?

1 answer is correct. Hard

1. A Because an attacker on the network cannot cause any damage
2. B Premature action alerts the attacker, who then uses other access
3. C Because backdoors disappear by themselves after a few days
4. D Because cleanup is always prohibited until the police have been on site