312-38 Certified Network Defender (CND)

When a Trojan is suspected to have infected a computer, the first course of action should be to contain the damage to prevent the malware from spreading or causing further harm.  This involves disconnecting the infected device from the network to isolate it and prevent the Trojan from communicating with potential command and control servers or infecting other systems 1 2 3 .

While informing the Incident Response Team (IRT) and other members of the organization is also important, these actions come after the immediate threat has been contained.  Therefore, the correct answer is to contain the damage (A), which aligns with the Certified Network Defender (CND) objectives that prioritize immediate containment to minimize the impact of security incidents 4 5 6 7 8 .

References : The response is based on best practices for dealing with Trojans as outlined in network security and incident response guidelines, including those from the EC-Council’s Certified Network Defender (CND) program.  The CND framework emphasizes the importance of quick containment to protect network integrity and prevent further damage 4 5 6 7 8 

After completing the vulnerability scanning process and identifying serious vulnerabilities, Harry will proceed through several phases of vulnerability management to address and eradicate these vulnerabilities. The phases include:

Mitigation : This phase involves taking steps to reduce the impact of the detected vulnerabilities. Mitigation strategies may include applying patches, adjusting configurations, or implementing compensating controls to lower the risk associated with the vulnerabilities.

Verification : In this phase, Harry will verify that the vulnerabilities have been successfully mitigated or remediated. This typically involves re-scanning the network to ensure that the vulnerabilities are no longer present or that their risk has been sufficiently reduced.

Remediation : This is the phase where Harry will take action to fix the vulnerabilities. Remediation can involve patching software, closing unnecessary ports, changing passwords, or other actions that directly address the identified security issues.

These phases are part of a broader vulnerability management lifecycle, which also includes assessing vulnerabilities and reassessing the network after remediation efforts to ensure continuous protection.

References : The explanation provided is based on the standard vulnerability management lifecycle, which includes assessment, prioritization, action (mitigation and remediation), reassessment, and improvement as outlined in cybersecurity resources 1 2 3 .