The correct answer is: c. Consult your security policy
The first thing you do if you suspect that your system has been compromised is consult your security policy. Your security policy will contain the procedures to follow to deal with the compromise. If you do not have a security policy you should immediately consult with management to ensure the recovery effort can be coordinated with other departments such as the media and legal teams. The next step is to regain control of your system, which involves the other options listed.
<< Back to quiz
This was first published in June 2005