Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

During routine network monitoring, a security operations center (SOC) analyst confirms the presence of an unauthorized rogue wireless access point connected directly to a wall port in the enterprise building. Following standard incident response procedures, which of the following actions should the analyst perform first?

  1. Disable the switch port associated with the rogue wireless access point.Answer
  2. B
    Reimage all client workstations located within the immediate physical floor section.
  3. C
    Conduct a post-incident lessons learned session to revise physical security controls.
  4. D
    Configure an external perimeter firewall rule to block inbound remote management traffic.

Answer

Disable the switch port associated with the rogue wireless access point.
Disabling the switch port isolates the rogue device from the network immediately, satisfying the requirement to contain the incident before executing recovery or post-incident activities.

Step-by-Step Solution

1
Determine the current incident response stage
The security incident has been detected and verified, placing the immediate requirement in the containment phase.
Containment halts the expansion of an active threat and prevents further unauthorized access to internal resources.
2
Select the immediate containment control
Disabling the underlying network switch port disconnects the unauthorized rogue device from the internal network infrastructure.
Isolating the rogue access point stops network exposure immediately, enabling safe proceeding to eradication and recovery phases.

Key Concept

Incident Response Lifecycle Containment Phase
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic