Examkin

Question

Difficulty: MediumIncident Response and Chain of Custody

While performing routine maintenance on a system administrator's workstation, a technician notices an unauthorized interactive remote shell executing administrative scripts in real time. The workstation contains volatile memory data critical for the incident investigation. Which action should the technician take FIRST to contain the threat while preserving digital evidence integrity?

  1. Disconnect the network interfaces to isolate the workstation while leaving the system powered on.Answer
  2. B
    Perform an immediate hard power-down by holding the power button to stop the active session.
  3. C
    Open Event Viewer and manually copy event log files to an unencrypted external flash drive.
  4. D
    Move the physical system unit to a lockable storage room before notifying the incident response team.

Answer

Disconnect the network interfaces to isolate the workstation while leaving the system powered on.
Isolating network interfaces (such as unplugging the Ethernet cable or disabling Wi-Fi) immediately halts remote command execution and data exfiltration without losing RAM contents. Keeping the system powered on preserves volatile forensic artifacts required for forensic imaging and memory analysis.

Step-by-Step Solution

1
Identify the active threat and assess the evidence state.
The workstation is undergoing an active remote attack, and volatile RAM holds vital forensic evidence.
Understanding the order of volatility dictates that live RAM data will be lost if the machine is powered off.
2
Isolate the compromised system from all network connections.
Network communication is terminated, stopping the remote attacker's access and preventing lateral spread across the network.
Network isolation contains the security incident immediately without altering or erasing volatile RAM evidence.
3
Escalate the incident to the designated Incident Response / Security Operations team.
Proper authorities take ownership of evidence collection and chain of custody documentation.
First responders must follow official reporting escalation policies once containment is established.

Key Concept

First Responder Incident Containment and Order of Volatility
Rate this question

Topics

Incident Response and Chain of Custody

More questions from this topic