Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

During a threat hunting exercise, a security analyst discovers an unauthorized scheduled cron job executing a reverse shell script on a critical internal server. The analyst immediately isolates the host from the network to prevent command-and-control communications. According to standard incident response playbooks, which of the following actions should the analyst perform NEXT?

  1. A
    Reconnect the server to the production network and monitor network traffic logs to confirm business operations are functioning normally.
  2. Identify the initial entry vector, eliminate the persistent scripts, and patch the exploited vulnerability on the isolated server.Answer
  3. C
    Convene a lessons-learned session with organizational leadership to update the incident response plan and document key performance indicators.
  4. D
    Update the risk management register to reclassify network isolation procedures as a deterrent security control.

Answer

The analyst should proceed to the eradication phase by identifying the entry vector, removing persistent malicious scripts, and patching the underlying vulnerability on the isolated system.
In standard incident response frameworks (such as NIST SP 800-61), once containment is established by isolating the host, responders must transition to the Eradication phase. Eradication requires identifying how the attacker gained access, removing all malicious artifacts (such as the persistent cron job and scripts), and mitigating vulnerabilities so the system can be safely restored.

Step-by-Step Solution

1
Identify the current incident response phase
Network isolation of the compromised host confirms that the Containment phase has just been executed.
Determining the active phase establishes the required sequential workflow under standard NIST/ISO incident response frameworks.
2
Determine the mandatory next phase in the lifecycle
The phase immediately following Containment is Eradication.
The incident response lifecycle follows a strict sequence: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Activity.
3
Select the action corresponding to Eradication
Analyzing root cause, removing persistence mechanisms (cron job/scripts), and applying security patches represent core Eradication activities.
Eradication ensures that all traces of the threat actor and vulnerabilities are remediated before any attempt is made to restore normal operations.

Key Concept

Incident Response Lifecycle Phase Ordering (Containment to Eradication)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic