Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

A security operations team has confirmed a active malware infection on a financial database administrator's workstation. Arrange the incident response playbook actions in the correct chronological order from first to last.

  1. 1Disconnect the affected workstation from the network by disabling its network interface.
  2. 2Capture a volatile RAM memory dump of the isolated system for forensic analysis.
  3. 3Remove persistent malicious artifacts and re-image the operating system from a secure baseline.
  4. 4Conduct a post-incident review meeting to document findings and refine incident playbooks.

Answer

The correct chronological sequence begins with host network isolation (containment), followed by volatile memory acquisition (forensics/preservation), followed by system sanitization and image restoration (eradication/recovery), and concludes with the post-incident review (lessons learned).
According to NIST SP 800-61 standards, once an incident is confirmed, the immediate step is Containment (isolating the host from the network). Next comes Evidence Preservation (capturing volatile RAM while the machine is running). Following evidence collection, Eradication and Recovery take place (removing malware and re-imaging from clean media). Finally, Post-Incident Activities (lessons learned) occur once operations return to normal.

Step-by-Step Solution

1
Isolate the infected host from the enterprise network.
Containment is achieved, halting active command-and-control communication and lateral propagation.
Immediate containment stops potential compromise progression before pursuing offline analysis.
2
Acquire volatile memory evidence prior to system shutdown.
RAM memory dump and volatile system state are preserved for investigation.
Volatile data resides in RAM and will be permanently lost if the machine is powered off or rebooted during remediation.
3
Perform eradication of threat artifacts and execute recovery procedures.
Malware persistence is removed and the system is safely restored to operational status from a verified baseline.
Eradication ensures the environment is clean before returning the system to production.
4
Hold a post-incident review and update documentation.
Lessons learned are compiled into an incident report to improve security operations.
Post-incident analysis evaluates performance metrics and identifies playbook improvements for future incidents.

Key Concept

NIST Incident Response Lifecycle (Containment, Evidence Preservation, Eradication/Recovery, Lessons Learned)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic