Which of the following incident response steps should the analyst take FIRST?

An analyst suspects a large database that contains customer information and credit card data was exfiltrated to a known hacker group in a foreign country. Which of the following incident response steps should the analyst take FIRST?
A. Immediately notify law enforcement, as they may be able to help track down the hacker group before customer information is disseminated.
B. Draft and publish a notice on the company’s website about the incident, as PCI regulations require immediate disclosure in the case of a breach of PII or card data.
C. Isolate the server, restore the database to a time before the vulnerability occurred, and ensure the database is encrypted.
D. Document and verify all evidence and immediately notify the company’s Chief Information Security Officer (CISO) to better understand the next steps.

CS0-002: CompTIA CySA+ Exam FULL Printable PDF and Software. VALID exam to help you PASS.