Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

A security analyst discovers that a workstation on the corporate network is actively communicating with a known malicious command-and-control server following a phishing incident. Which of the following actions should the analyst perform as part of the containment phase? (Select TWO).

  1. Disconnect the compromised workstation from both wired and wireless network interfaces.Answer
  2. B
    Re-image the workstation operating system to eliminate malicious artifacts.
  3. Disable the user account associated with the compromised workstation.Answer
  4. D
    Conduct a post-incident review meeting with key operational stakeholders.

Answer

Disconnecting the compromised workstation from all network interfaces and disabling the associated user account are the appropriate immediate containment steps.
During the containment phase, the primary goal is to isolate affected systems and accounts to prevent further spread or data exfiltration. Disconnecting the endpoint from wired/wireless networks halts external communication and lateral movement. Disabling the compromised user account prevents stolen credentials from being reused elsewhere across the domain.

Step-by-Step Solution

1
Identify the primary objective during the containment phase of incident response.
Recognize that containment aims to halt the spread of the attack and limit damage immediately without destroying volatile evidence.
Containment limits threat exposure before active remediation begins.
2
Evaluate network isolation as a containment mechanism.
Disconnecting network interfaces immediately cuts off adversary access to command-and-control infrastructure and prevents lateral movement.
Network isolation stops active data exfiltration and further spreading.
3
Evaluate identity control measures during containment.
Disabling the compromised user account prevents unauthorized access to cloud and network resources from secondary endpoints.
Account disabling restricts access vectors associated with potentially leaked credentials.

Key Concept

Incident Response Containment Phase Actions
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic