You are responding to an incident in which the organization's Extranet server has been compromised. The Extranet is the browser home page for most users in the organization. You have been instructed to watch the attacker, but minimize the business impact and the risk of further compromise. How can you continue providing services to the organization's users while isolating the compromised server?
To minimize business impact and the risk of further compromise while watching the attacker's actions, you should reroute DNS to a secondary, patched production server. This allows continuous service for users by redirecting them to a secure server, while still monitoring the compromised server. The other options either disrupt service for users or make it more difficult to track the attacker's activity.
Isn't C better option? With option A, you don't isolate attacked server, you just redirect the attack.
Isn't C better option? With option A, you don't isolate attacked server, you just redirect the attack.