Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

During security monitoring of an enterprise cloud environment, an automated alert flags an unauthorized microservice container actively establishing encrypted outbound connections to an external command-and-control (C2) server. Security analysts verify that the container is compromised and holds active database connection tokens. According to standard incident response frameworks, which of the following actions should the security team perform FIRST?

  1. Apply network isolation rules to contain the compromised container and prevent lateral movement or data exfiltration.Answer
  2. B
    Terminate and purge the compromised container instance immediately from the cluster host.
  3. C
    Redeploy the microservice using updated container base images from the CI/CD pipeline.
  4. D
    Convene a post-incident lessons learned review with the DevOps team to update infrastructure-as-code security policies.

Answer

Apply network isolation rules to contain the compromised container and prevent lateral movement or data exfiltration.
The correct action is to apply network isolation rules to contain the compromised container. Under standard incident response frameworks (NIST SP 800-61 / ISO 27035), once an incident is verified during detection and analysis, the immediate next step is containment to restrict attacker access, halt active exfiltration, and prevent lateral movement within the network.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle.
The incident has been detected and verified, moving the response process into the Containment, Eradication, and Recovery phase.
Once an active breach is confirmed, immediate focus must shift to limiting the scope and impact of the incident.
2
Determine the mandatory initial action within the Containment phase.
Apply containment measures (such as network microsegmentation or isolation security group rules) to cut off C2 communication and stop lateral movement.
Containment prevents further data loss or damage while keeping the compromised artifact available for volatile memory capture or analysis.
3
Evaluate remaining actions against the IR lifecycle order.
Actions such as terminating workloads (eradication), redeploying clean builds (recovery), or running post-mortems (lessons learned) occur sequentially after containment.
Executing out-of-order steps exposes the organization to continued risk or destroys critical forensic evidence.

Key Concept

Incident Response Lifecycle Phase Order (Containment First)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic