Extreme Emergency procedures in case of testing incidents typically involve which action?

• A. Shutting down the test environment.
• B. Running a broad network scan.
• C. Coordination with admins to create test accounts on test machines and test lockouts.
• D. Immediately delete logs.

Answer: (C)

Extreme emergency procedures in a testing incident center on rapid containment and maintaining controlled, auditable access to the affected systems. Coordinating with admins to create test accounts on the test machines and to implement test lockouts does two important things: it gives you a safe, isolated way to interact with the environment without relying on potentially compromised production credentials, and it allows quick revocation or adjustment of access as the situation evolves. This keeps the blast radius contained, supports clean incident handling, and preserves the ability to document what happened.

Other approaches either disrupt the balance between containment and continuity or hinder incident response. A blunt shutdown of the test environment can halt investigation and recovery efforts. Running a broad network scan during an emergency risks further disruption or misconfiguration. Deleting logs eliminates critical forensic data needed to understand the incident and learn from it.