Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst confirms an active security incident involving a critical Linux database server hosting sensitive customer records. An external attacker has established an interactive reverse shell via a web application vulnerability, and an automated script on the system is actively staging database tables into an encrypted archive for exfiltration. The incident response playbook requires halting exfiltration immediately while preserving volatile system memory for subsequent forensic analysis. Which of the following actions should the analyst take FIRST?

  1. Disconnect the database server from the network segment at the switch or firewall level while leaving the system powered on.Answer
  2. B
    Execute a system shutdown command or pull the physical power plug to immediately stop the data exfiltration process.
  3. C
    Restore the database server operating system and application files from a clean backup.
  4. D
    Update the Web Application Firewall (WAF) rule base to block incoming HTTP payload requests targeting the web application.

Answer

Network isolation at the switch or firewall level while maintaining host power is the primary first action.
Disconnecting the database server from the network segment (short-term containment) immediately stops outbound exfiltration and C2 communications while keeping the system powered on so that volatile memory (RAM), running processes, and open network sockets remain intact for forensic capture.

Step-by-Step Solution

1
Analyze the active threat and requirements
Identified an active reverse shell staging data for exfiltration with a requirement to stop exfiltration and preserve volatile memory (RAM).
The NIST/ISO incident response lifecycle mandates containment before eradication and recovery.
2
Evaluate containment strategies against volatile evidence preservation
Network isolation stops outbound communication and exfiltration without losing RAM contents.
Shutting down the host causes catastrophic loss of volatile memory, while network isolation isolates network traffic without powering down.
3
Distinguish between preventive ingress controls and active incident containment
WAF rule updates prevent future exploitation but do not terminate active established C2/exfiltration streams.
Active containment must take precedence over ingress hardening during active compromise execution.

Key Concept

Incident Response Containment Phase and Volatile Evidence Preservation
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic