問題文
An alert fires: a service user has run an unusually large extraction to an external stage at 03:00. The security engineer confirms the activity was not scheduled. What should happen first?
選択肢
- Leave the credential active so that the attacker's next action can be observed, and let the extraction continue while the monitoring team watches the stage.
- Begin drafting the incident report so that the timeline is captured while the details are fresh, and use the draft to decide which containment steps are worth taking.
- Contain the incident by isolating that service user and revoking the credential it authenticated with.
- Restore the affected tables from Time Travel to a state before the extraction, so that the data is known-good before any further investigation begins and the business can continue working on a clean copy.