Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During a suspected breach investigation, a security handler observes that an API gateway server hosting sensitive internal workflows is attempting unauthorized outbound network traffic to a known command-and-control server following a successful zero-day exploit execution. According to standard NIST incident response guidelines, which of the following actions should the handler execute FIRST?

  1. Isolate the API gateway server from the network via microsegmentation to prevent data exfiltration while preserving system volatile memory.Answer
  2. B
    Delete the malicious payload executable and clear temporary directory paths on the server host file system.
  3. C
    Restore the API gateway host from a clean virtual machine snapshot to bring production services back online immediately.
  4. D
    Reconfigure network audit policies to establish a corrective control monitoring future exploit attempts on the gateway.

Answer

Isolate the API gateway server from the network via microsegmentation to prevent data exfiltration while preserving system volatile memory.
In accordance with standard NIST incident response frameworks (NIST SP 800-61), once an active intrusion or C2 communication is confirmed, containment must occur before eradication or recovery steps. Isolating the system via microsegmentation halts outbound data exfiltration and lateral movement while keeping the system in a state suitable for volatile memory capture and forensic analysis.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario description.
The incident has been detected and confirmed active (active C2 communication), placing the handler at the transition into the Containment, Eradication, and Recovery phase.
Before performing active system modifications, the immediate priority is limiting breach scope and preventing exfiltration.
2
Evaluate containment actions against eradication and recovery actions.
Network isolation contains the threat immediately without altering host volatile memory needed for forensic capture.
Standard NIST SP 800-61 frameworks dictate containing the incident prior to executing eradication steps like deleting malicious binaries or performing host imaging.
3
Select the correct immediate next step.
Isolating the server using microsegmentation or host isolation controls is the required first response action.
This halts attacker interaction while preserving system state for evidence preservation.

Key Concept

Incident Response Lifecycle Order (Containment before Eradication/Recovery)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic