What are the core priorities when responding to a cyber event impacting AVN C3 RC?

What are the core priorities when responding to a cyber event impacting AVN C3 RC?

• A. Isolate the affected segment, preserve evidence, and recover operations.
• B. Patch all systems immediately without analysis.
• C. Shut down all communications permanently.
• D. Wait for orders before acting.

Answer: (A)

The main idea is to act in order to limit damage, preserve information for investigation, and restore essential functions. When a cyber event occurs, the first priority is to isolate the affected segment so the attack can’t move laterally to other parts of the network. This containment helps stop the spread and protects the rest of the system while you assess what happened. Next, preserve evidence. Collect and safeguard volatile data (like memory and active logs) and ensure you maintain a proper chain of custody for all artifacts. This lets you understand the attacker’s method, determine timelines, and support any investigations or legal actions later on. Finally, focus on recovering operations. Restore critical services and systems in a controlled way, validate integrity, and implement fixes to bring mission-essential capabilities back online. This sequence—containment, evidence preservation, and recovery—balances stopping the threat, understanding it, and maintaining essential operations. Patching everything without analysis, shutting down communications permanently, or waiting for orders before acting would either worsen the situation, erase evidence, or leave critical operations unavailable.

The main idea is to act in order to limit damage, preserve information for investigation, and restore essential functions. When a cyber event occurs, the first priority is to isolate the affected segment so the attack can’t move laterally to other parts of the network. This containment helps stop the spread and protects the rest of the system while you assess what happened.

Next, preserve evidence. Collect and safeguard volatile data (like memory and active logs) and ensure you maintain a proper chain of custody for all artifacts. This lets you understand the attacker’s method, determine timelines, and support any investigations or legal actions later on.

Finally, focus on recovering operations. Restore critical services and systems in a controlled way, validate integrity, and implement fixes to bring mission-essential capabilities back online. This sequence—containment, evidence preservation, and recovery—balances stopping the threat, understanding it, and maintaining essential operations.

Patching everything without analysis, shutting down communications permanently, or waiting for orders before acting would either worsen the situation, erase evidence, or leave critical operations unavailable.