During a routine security audit, an organization's security team detects an unusual spike in network traffic originating from one of their internal…

The initial assessment phase of incident response focuses on validating the incident, understanding its immediate scope, and taking urgent steps to prevent further damage. Reviewing network logs (E) is a fundamental analysis task to confirm the intrusion, identify the timeline, and search for related indicators of compromise (IoCs). Concurrently, disconnecting the compromised server from the network (B) is a critical containment action. Given the high confidence of compromise (communication with a known malicious IP), this step is taken immediately to stop malicious activity, prevent data exfiltration, and halt potential lateral movement across the network.

A. Notifying law enforcement agencies is a decision made after the incident's scope and impact are better understood, and it typically involves management and legal counsel.
C. A comprehensive forensic analysis is part of a deeper investigation phase that occurs after initial containment, not during the rapid initial assessment.
D. Interviewing employees is a valid investigative step but is secondary to the immediate technical analysis of logs and containment of the active threat.

1. NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide": This guide outlines the incident response lifecycle. The "Detection & Analysis" phase involves analyzing data (like logs) to confirm an incident. The subsequent "Containment, Eradication, & Recovery" phase begins with containment. The guide states, "Containment is the first step in recovery... containment provides time for developing a tailored remediation strategy." (Section 3.3.1, Page 25). The initial assessment informs the immediate need for containment, making both actions critical at the start of the response.

2. Cisco, "Security Incident Response": Official Cisco documentation on their incident response services emphasizes a phased approach. The "Triage" or "Analysis" phase involves "reviewing available data, such as logs... to determine the nature of the event." The "Containment" phase, which happens immediately after or in parallel, aims to "stop the current impact of the incident and prevent it from spreading further." Disconnecting a host is a primary containment technique. (Reference: Cisco Incident Response Service At-a-Glance document).

3. Carnegie Mellon University, Software Engineering Institute, "Defining Incident Management Processes for CSIRTs": This document describes the incident handling process. The "Analyze" step involves gathering information from logs and other sources to characterize the incident. The "Contain" step, which follows immediately, is described as actions to "stop the incident from causing further damage." (Section 3.2, "A High-Level View of the Incident Management Process"). This supports the tight coupling of initial analysis (log review) and immediate containment (disconnection).