Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During security operations monitoring, incident responders confirm an active data exfiltration event where an internal database server is sending bulk sensitive records via covert DNS port 53 queries to an untrusted external domain. According to standard incident response lifecycle frameworks, which of the following actions represents the immediate next step the incident response team should perform?

  1. A
    Re-image the database server using clean baseline installation media to restore normal business operations.
  2. Isolate the compromised database host from the network and block the external destination domain at the egress firewall.Answer
  3. C
    Deploy web application firewall rules to sanitize incoming database queries against Cross-Site Scripting and SQL injection payloads.
  4. D
    Initiate automated network-wide scans to remove self-replicating worm modules from shared directory paths.

Answer

Isolate the compromised database host from the network and block the external destination domain at the egress firewall.
Isolating the host or blocking the external destination domain directly addresses the containment phase of the incident response lifecycle. Halting the DNS tunneling channel prevents additional data loss while keeping the host available for volatile memory capture and forensic investigation.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
The incident has been detected and validated as an ongoing breach (data exfiltration in progress).
Recognizing active exfiltration places the incident response team immediately into the containment phase.
2
Apply NIST SP 800-61 containment strategies to halt threat impact.
Network isolation and egress blocking immediately interrupt the exfiltration channel.
Containment limits damage to enterprise assets before forensic preservation, eradication, and recovery begin.
3
Evaluate distractors for out-of-sequence or mismatched control responses.
Actions such as host re-imaging belong to eradication/recovery, while WAF tuning misdiagnoses the DNS tunneling vector.
Standard IR playbooks strictly require containment to precede eradication and recovery.

Key Concept

Incident Response Lifecycle Containment Phase
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic