When investigating a malware incident in a Kubernetes workload, what should be your first action?

• A. Notify the workload owner and begin the incident response playbook
• B. Quarantine the cluster and delete the running pod
• C. Silence the alert and monitor
• D. Ignore the alert if centroid scoring is low

Answer: (A)

When a malware incident is detected in a Kubernetes workload, the immediate action is to notify the workload owner and activate the incident response playbook. This ensures proper escalation, governance, and coordinated response with the right people involved, so containment, evidence collection, and recovery steps follow a documented plan. Quarantining the cluster or deleting a running pod without authorization can cause unnecessary outages and data loss and should come after the incident plan dictates containment. Silencing or ignoring the alert bypasses established procedures and risks the incident worsening; always start with notifying the owner and triggering the playbook.