CompTIA Security+ (SY0-601) — Question 230

The help desk has received calls from users in multiple locations who are unable to access core network services. The network team has identified and turned off the network switches using remote commands. Which of the following actions should the network team take NEXT?

Answer options

• A. Disconnect all external network connections from the firewall.
• B. Send response teams to the network switch locations to perform updates.
• C. Turn on all the network switches by using the centralized management software.
• D. Initiate the organization's incident response plan.

Correct answer: D

Explanation

The correct action is to initiate the organization's incident response plan, as it provides a structured approach to handle the situation. Simply turning on the network switches or sending teams for updates may not address the underlying issues effectively. Disconnecting external connections could also be premature without a clear understanding of the problem.