Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

A security handler confirms that a cloud administrator host is actively exporting database backups to an unapproved external storage endpoint using hijacked API credentials. Following standard incident response procedures, which of the following actions should the security handler take FIRST?

  1. Revoke the compromised API credentials and restrict the host's network connectivity.Answer
  2. B
    Reimage the host operating system and restore database files from verified offline backups.
  3. C
    Deploy a web application firewall rule designed to block cross-site scripting attack payloads.
  4. D
    Initiate network-wide antivirus scanning to remove self-replicating network worm components.

Answer

Revoke the compromised API credentials and restrict the host's network connectivity.
In standard incident response frameworks (such as NIST SP 800-61), once an active breach or exfiltration event is detected, containment is the immediate priority. Revoking compromised API keys and isolating the affected system prevents further data loss without altering offline forensic evidence.

Step-by-Step Solution

1
Analyze the incident scenario and determine the current phase of incident response.
An active data exfiltration incident is occurring via hijacked administrative credentials.
Immediate containment is required to minimize exposure and halt ongoing unauthorized access.
2
Select the appropriate immediate containment action according to standard NIST IR playbooks.
Revoking session keys/credentials and isolating the administrator host halts exfiltration immediately.
Containment actions must precede eradication (reimaging) or recovery (restoring from backups).

Key Concept

Incident Response Lifecycle - Containment Phase
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic