Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

An incident response team is investigating a confirmed security incident on a Linux application server hosting an internal logistics portal. Monitoring alerts indicate an unauthorized remote access session is currently active, and the compromised host has begun scanning adjacent internal subnets for lateral movement. According to standard incident response frameworks, which TWO of the following immediate actions should the analyst take during the containment phase?

  1. Isolate the compromised server's network segment by updating network security group rules to restrict lateral movement while keeping the system powered on.Answer
  2. Capture a volatile memory snapshot of the system to preserve running processes and active network connection states before taking the host offline.Answer
  3. C
    Re-image the server operating system from a clean baseline backup to immediately purge all attacker artifacts.
  4. D
    Reconfigure perimeter firewalls to change existing preventive access control lists into detective logging rules.

Answer

The analyst should isolate the server's network segment using security group rules while keeping the machine powered on, and capture a volatile memory snapshot before taking the host offline.
The correct response combines network isolation to halt lateral movement with volatile memory acquisition to preserve ephemeral evidence. Isolating the system via network security groups stops the adversary from reaching adjacent subnets, while taking a memory capture ensures active process memory, network connections, and memory-resident malware artifacts are preserved before host shutdown or remediation.

Step-by-Step Solution

1
Identify the primary objective during the containment phase of incident response.
Containment aims to prevent the spread of the incident (lateral movement) and limit damage without destroying volatile evidence.
Stopping active scanning to adjacent subnets is urgent to safeguard internal enterprise resources.
2
Evaluate containment actions regarding host state and evidence preservation.
Applying network-level isolation via security groups stops lateral network traffic, while capturing RAM preserves volatile evidence prior to any disruptive actions.
Maintaining power while restricting network communications allows memory forensic acquisition without alerting the threat actor or losing RAM contents.
3
Differentiate containment phase actions from eradication, recovery, or misconfigured controls.
Re-imaging systems belongs to the eradication/recovery phase, and altering preventive controls to detective logging reduces defensive capability.
Incident response playbooks mandate executing phases in sequence to ensure root cause determination and full containment before system restoration.

Key Concept

Incident Response Containment Phase and Volatile Evidence Preservation
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic