Answer the following questions:

Khalid is the network administrator of a company. Due to the sudden slowdown of his network, Khalid understood that there is a possibility of an attack to his network. He is starting to investigate his network for any intrusive activity. Answer the following questions in this context.

i. What should Khalid do as an initial response to this incident?

ii. What are the points Khalid should focus on when creating a response plan?

iii. Write any Four situations where Khalid can switch his data collection mode to proactive?