Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During a routine SOC escalation, an analyst discovers that a compromised staging CI/CD build server is executing unauthorized outbound SSH tunnels to an external IP address while pulling credentials from an internal vault. The server maintains active service accounts with administrative privileges to production clusters. Following standard NIST SP 800-61 incident response guidelines, which of the following actions should the analyst perform FIRST?

  1. Isolate the build server from the network and revoke the associated service account credentials.Answer
  2. B
    Re-image the build server operating system using a known-good baseline configuration file.
  3. C
    Modify network Intrusion Detection System (IDS) signatures to generate alerts on subsequent SSH tunneling attempts.
  4. D
    Initiate a full system forensic disk image copy while keeping all live network connections active to observe threat actor behavior.

Answer

Isolate the build server from the network and revoke the associated service account credentials.
The correct action prioritizes the containment phase of the incident response lifecycle. Disconnecting the compromised system from the network and revoking elevated service credentials immediately mitigates the risk of lateral movement into production environments and halts active exfiltration.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario indicators.
The incident is actively occurring with ongoing unauthorized outbound traffic and lateral movement risk.
Determining the phase ensures adherence to standard incident handling frameworks (NIST SP 800-61 / ISO 27035).
2
Select the immediate containment step to stop active impact.
Network isolation of the host and revocation of compromised staging/production service accounts.
Containment limits the scope of damage and prevents attackers from pivoting into production before eradication begins.

Key Concept

Incident Response Containment Phase Priority
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic