What should be the FIRST action for a security administrator who detects an intrusion on...

The first action for a security administrator who detects an intrusion on the network based on precursors and other indicators is to isolate and contain the intrusion. An intrusion is an unauthorized or malicious activity that attempts to compromise the security or the functionality of a system or a network. An intrusion can be detected by various methods, such as the analysis of the network traffic, the logs, the alerts, or the anomalies. Precursors and indicators are the signs or the evidence of an intrusion or an attempted intrusion. Precursors are the events or the activities that occur before or during an intrusion, such as the reconnaissance, the scanning, or the probing. Indicators are the events or the activities that occur after or as a result of an intrusion, such as the exploitation, the backdoor, or the payload. The first action for a security administrator who detects an intrusion on the network is to isolate and contain the intrusion, which means to disconnect or block the affected system or network from the rest of the environment and prevent the intrusion from spreading or causing more damage. Isolating and containing the intrusion can help protect the other systems or networks from being compromised, preserve the evidence for the investigation, and facilitate the recovery and the restoration of the normal operations. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, page 364. Free daily CISSP practice questions, Question 4.