Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

During a security incident, an organization's Security Operations Center (SOC) identifies a compromised containerized application actively scanning internal microservices for vulnerabilities. Place the following incident response actions in the correct sequential order from FIRST to LAST according to standard incident handling frameworks.

  1. 1Isolate the compromised container by applying microsegmentation network policies to block outbound traffic to internal services.
  2. 2Capture volatile memory artifacts and container runtime logs while preserving chain of custody.
  3. 3Terminate the compromised container instance and redeploy the microservice using a clean, verified image from a secure registry.
  4. 4Restore normal production routing to the microservice while actively monitoring network telemetry for anomalous activity.
  5. 5Conduct a post-mortem review with the DevOps team to update container security controls and CI/CD pipeline scanning rules.

Answer

The correct order of incident response actions is: 1) Isolate the compromised container using microsegmentation network policies; 2) Capture volatile memory artifacts and container runtime logs; 3) Terminate the compromised container instance and redeploy from a verified clean image; 4) Restore normal production routing while monitoring network telemetry; 5) Conduct a post-mortem review to update container security controls.
Standard incident handling frameworks (such as NIST SP 800-61) follow a strict lifecycle order: Containment (isolating network traffic) occurs first to stop active damage; Evidence Preservation collects volatile forensic artifacts before system modification; Eradication removes the root cause by destroying the compromised instance and deploying a trusted build; Recovery restores production operations under enhanced monitoring; Post-incident Activity reviews performance and updates playbooks to enhance future resiliency.

Step-by-Step Solution

1
Determine the Containment Step
Network isolation via microsegmentation is placed first.
Immediate containment stops active lateral movement and limits incident scope before any destructive or disruptive changes are made.
2
Determine the Evidence Preservation Step
Volatile memory and log collection is placed second.
Evidence preservation must happen while the system remains isolated but before deleting or rebuilding the container instance.
3
Determine the Eradication Step
Termination of the container and redeployment from a clean image is placed third.
Eradication removes the threat vectors and compromised binaries once evidence has been secured.
4
Determine the Recovery Step
Restoring traffic with active telemetry monitoring is placed fourth.
Recovery brings systems safely back into full production under close monitoring to confirm stability.
5
Determine the Lessons Learned Step
Post-mortem review and CI/CD security updates are placed fifth.
Post-incident analysis evaluates the incident response effort after operational restoration to prevent future recurrence.

Key Concept

NIST Incident Response Lifecycle (Containment, Evidence Preservation, Eradication, Recovery, Lessons Learned)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic