The security administrator for a large organization receives numerous alerts from a network-based intrusion detection system (nids) of a possible worm infection spreading through the network via network shares. before taking any drastic action to solve this problem such as blocking file sharing, what should first be done?

a. perform a pilot study of the solution and monitor for adverse affects look for a less radical solution
b. call an emergency change management meeting to ensure the solution will not have unforeseen negative affects.
c. block file sharing immediately because this is an emergency that could lead to a widespread data compromise.
d. research best practices with respect to stopping the worm and implement the solution without delay.