Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst detects an unauthorized third-party integration added to an enterprise cloud tenant, followed by bulk exfiltration of sensitive email records via an exposed OAuth 2.0 token. According to standard incident response frameworks, in what sequence should the IR team execute the following response and recovery steps?

  1. 1Revoke the malicious OAuth 2.0 token and isolate compromised user accounts to stop ongoing data exfiltration.
  2. 2Remove the rogue third-party app integration from the cloud tenant and audit all remaining enterprise application permissions.
  3. 3Restore compromised account configurations, issue new authentication credentials, and re-enable monitored email services.
  4. 4Conduct a post-incident review with security leadership to document the attack timeline and update cloud application consent policies.

Answer

The correct order of incident response steps is: 1) Revoke the malicious OAuth 2.0 token and isolate compromised user accounts to stop ongoing exfiltration (Containment); 2) Remove the rogue third-party app integration from the cloud tenant and audit application permissions (Eradication); 3) Restore compromised account configurations, issue new credentials, and re-enable monitored email services (Recovery); 4) Conduct a post-incident review to document the timeline and update consent policies (Lessons Learned).
NIST SP 800-61 Rev 2 incident response playbooks require executing steps sequentially: Containment (revoking tokens/isolating accounts to stop damage), Eradication (deleting rogue applications to remove persistence), Recovery (restoring account configurations and services safely), and Lessons Learned (post-incident reviews to refine policy and controls).

Step-by-Step Solution

1
Identify initial Containment actions
Revoking the active OAuth token and isolating affected accounts immediately halts unauthorized data exfiltration.
Containment is the priority operational phase immediately following detection to minimize blast radius.
2
Identify Eradication actions
Deleting the rogue OAuth application integration removes the threat actor's persistence mechanism.
Eradication eliminates root-cause vulnerabilities and malicious artifacts once active threats are contained.
3
Identify Recovery actions
Resetting credentials and re-enabling email services returns the business environment to normal baseline operation.
Recovery validates that systems are clean and monitored before restoring them to full production.
4
Identify Post-Incident / Lessons Learned actions
Documenting metrics and updating cloud consent policies hardens governance against similar attack vectors.
Lessons learned activities synthesize incident metrics to strengthen controls and update playbooks post-remediation.

Key Concept

Incident Response Lifecycle Phases (NIST SP 800-61 Rev 2 / CompTIA IR Framework)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic