Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

A Security Operations Center (SOC) team validates an active alert showing that a core database server hosting sensitive human resources data is performing covert DNS tunneling to transmit data to an external command-and-control (C2) IP address. The incident has been confirmed and analyzed. According to the NIST SP 800-61 incident response lifecycle, which of the following actions should the incident response team perform FIRST?

  1. Isolate the compromised database server from the network by adjusting security group rules or applying a containment VLAN.Answer
  2. B
    Revoke all compromised administrative credentials and terminate the active tunneling processes on the host.
  3. C
    Reimage the host operating system and restore the database from the most recent clean snapshot.
  4. D
    Deploy detective file integrity monitoring (FIM) agent policies across all internal domain servers.

Answer

Isolate the compromised database server from the network by adjusting security group rules or applying a containment VLAN.
According to standard NIST SP 800-61 guidelines for incident response, once an incident is detected and confirmed, the immediate next phase is Containment. Isolating the affected database server stops active DNS tunneling exfiltration and prevents lateral movement while maintaining volatile system evidence for forensic analysis.

Step-by-Step Solution

1
Identify the current phase in the NIST SP 800-61 incident response framework based on scenario context.
The incident has already been detected and analyzed; the active incident requires immediate mitigation to prevent further damage.
The scenario states that the breach is validated and data exfiltration via covert DNS tunneling is actively occurring.
2
Determine the required primary objective for an ongoing data exfiltration event.
Prevent further data loss and restrict adversary control over the compromised asset.
Containment limits the scope of an incident before permanent recovery or root-cause remediation steps are executed.
3
Select the action that aligns with the containment phase prior to eradication or recovery.
Isolating the database server from the network effectively halts DNS tunneling exfiltration while preserving system state.
Network isolation contains the threat immediately without altering volatile memory or alerting attackers prior to isolating the breach.

Key Concept

Incident Response Lifecycle Phase Order (Containment before Eradication and Recovery)
Estimated Time:2m 0s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic