What did Joseph do to troubleshoot the website vandalism?

• A. He disconnected from the corporate network and accessed the website using his dial-up ISP.
• B. He contacted the hosting provider and requested a security audit.
• C. He restarted the web server to clear the defacement.
• D. He scanned his own computer for malware

Answer: (A)

The main idea here is to isolate the incident to see where the problem originates. By disconnecting from the corporate network and accessing the website through a dial-up connection, Joseph removes any influence from his internal machines or internal network. This external path acts like an independent tester: if the defacement appears even when using a separate, non‑corporate route, the issue is likely with the hosting environment, DNS, or an external attacker. If the vandalism doesn’t appear on that dial-up path, it suggests the problem could be coming from inside the corporate network or from a device within that environment.

This approach helps preserve evidence and guides next steps without contaminating the investigation through the internal network. Restarting the web server could erase helpful data and doesn’t diagnose where the compromise originated, and scanning his own computer for malware targets his workstation rather than the website itself. Contacting the hosting provider is important for remediation, but it doesn’t individually establish whether the issue is internal or external; the external test is the quickest way to triage and scope the incident.