Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

During network monitoring, a security team identifies an unauthorized device acting as a rogue DHCP server on a corporate office VLAN, assigning malicious default gateway addresses to internal endpoints. The incident response team has confirmed the alert and identified the specific physical switch port connected to the rogue device. According to standard incident response procedures, which of the following actions should the team perform next?

  1. Shut down the identified switch port to isolate the rogue device from the localized network segment.Answer
  2. B
    Perform a complete system wipe and re-image on all endpoints that received the unauthorized DHCP leases.
  3. C
    Capture volatile RAM artifacts from all client workstations before taking network mitigation steps.
  4. D
    Create a SIEM correlation rule to log and alert on unauthorized DHCP offer packets across all network subnets.

Answer

Shut down the identified switch port to isolate the rogue device from the localized network segment.
In accordance with standard incident response frameworks (such as NIST SP 800-61), after detecting and analyzing an active threat, the immediate priority is Containment. Disabling the switch port connected to the rogue DHCP server immediately prevents the unauthorized device from sending additional malicious network configurations to clients.

Step-by-Step Solution

1
Analyze the current phase in the incident response lifecycle based on the scenario context.
The incident team has already detected and analyzed the incident, confirming the presence and physical location of the rogue DHCP server.
According to the NIST SP 800-61 IR framework, once an active incident is detected and identified, the immediate next phase is Containment.
2
Evaluate the proposed response actions against containment objectives.
Disabling the specific switch port stops the rogue DHCP server from issuing further unauthorized leases without shutting down unrelated network segments.
Effective containment isolates the threat immediately to prevent further damage while preserving operational stability.
3
Distinguish containment steps from out-of-order eradication, forensic, or detective steps.
Actions such as host re-imaging (eradication/recovery) or creating monitoring rules (detection/prevention) must not supersede active containment.
Following proper IR phase sequencing ensures active risks are neutralized before remediation and long-term improvements begin.

Key Concept

Incident Response Lifecycle Phase Order (Containment Phase Next Step)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic