Monitoring alerts show a database account exported large volumes of customer records overnight, and management suspects data theft that may lead to legal action. What should the DBA do first?
Select an answer to reveal the explanation.
Short Explanation
Think of it as a crime scene: if you start mopping the floor, you've wiped away the footprints you'll need later. Preserve and copy the logs first, with a chain of custody, so the evidence holds up. Restarting the service or purging logs feels decisive, but you're destroying exactly what investigators need.
Full Explanation
When an incident may lead to legal or disciplinary action, the first priority is to preserve evidence in a way that keeps it admissible. That means securing audit logs, connection logs, operating system logs and relevant database state, making forensic copies, recording hashes to prove the copies are unaltered, and documenting who handled each item and when as a chain of custody. Containment steps follow, and should be coordinated with the incident response team so they do not destroy evidence. Restoring from backup overwrites the current state, erasing traces of what was accessed or changed and possibly removing records needed to scope the breach. Restarting the service ends sessions but also clears volatile information such as active connections and in-memory state that may show what the attacker was doing. Dropping the account and purging its logs removes the very records that would identify the activity, and deleting logs can itself violate retention and legal hold obligations. Exam caveat: if exfiltration is still in progress, the account can be disabled to contain it, but disabling preserves the account and its history, unlike dropping it. Operational check: verify the hashes of the collected evidence copies, store them in restricted storage, and confirm the custody log records every transfer.