Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

During security operations monitoring, an analyst receives an alert indicating anomalous API token creation and unexpected mass repository downloads originating from a compromised developer endpoint connected via VPN. The analyst confirms that an external threat actor is actively leveraging these stolen credentials to access private source code repositories. According to NIST incident response guidelines, which of the following immediate actions should the incident response team perform during the Containment phase of this incident? (Select TWO)

  1. Revoke active VPN sessions and invalidate all API tokens associated with the compromised developer account.Answer
  2. B
    Re-image the compromised developer workstation and restore repository data from the latest validated backup.
  3. Apply restrictive host-based firewall rules to isolate the affected workstation while preserving volatile system memory for analysis.Answer
  4. D
    Conduct a lessons learned meeting with management to update internal credential management policies.

Answer

The correct containment actions are revoking the active VPN sessions and invalidating stolen API tokens associated with the account, as well as applying host-based firewall rules to isolate the compromised endpoint while preserving volatile memory.
During the containment phase of an incident response process, the goal is to prevent the threat from spreading or causing further damage while preserving forensic evidence. Revoking compromised credentials and API tokens stops the attacker from continuing exfiltration, while network-isolating the host prevents lateral movement while preserving volatile system RAM for forensic investigation.

Step-by-Step Solution

1
Identify the primary phase of the incident response lifecycle requested in the scenario.
The scenario specifically asks for actions appropriate for the Containment phase of the NIST SP 800-61 IR framework.
Containment limits the scope and impact of an active breach before recovery steps begin.
2
Evaluate containment actions that immediately halt adversary activity without destroying digital evidence.
Revoking active credentials/tokens stops ongoing unauthorized remote access. Isolating the workstation network interface prevents lateral movement while retaining volatile RAM data.
Effective containment balances stopping threat activity with evidence preservation.
3
Distinguish containment phase actions from eradication, recovery, or post-incident activities.
Actions such as re-imaging hosts or holding lessons learned sessions belong to later IR phases.
Prematurely re-imaging hosts destroys forensic evidence before containment and investigation are complete.

Key Concept

NIST Incident Response Containment Phase Strategies
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic