Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

A security analyst identifies an active incident where a web server is communicating with an unauthorized external command-and-control (C2) server. According to standard incident response playbooks, which of the following initial actions should the incident response team perform during the containment phase? (Select TWO.)

  1. Isolate the compromised web server from the local network segment.Answer
  2. Implement outbound firewall block rules targeting the external command-and-control IP address.Answer
  3. C
    Re-image the compromised web server using a known-good baseline installation image.
  4. D
    Conduct a post-incident review meeting with stakeholders to update existing IR playbooks.

Answer

Isolate the compromised web server from the local network segment and implement outbound firewall block rules targeting the external command-and-control IP address.
During the containment phase, the immediate objective is to stop the spread of the attack and prevent further unauthorized access or exfiltration. Isolating the server prevents lateral spread within the subnet, while blocking the external destination IP at the boundary firewall cuts off remote adversary control. Both actions fit directly into the containment playbook.

Step-by-Step Solution

1
Determine the current phase of the incident response process based on the active state of the compromise.
Because active external communication and host compromise are occurring in real time, response efforts must focus on Containment.
Containment limits the scope and impact of an incident before technical remediation can take place.
2
Identify specific technical actions that halt the spread of the attack without destroying live evidence prematurely.
Disconnecting/isolating the host from the network and blocking outbound connection attempts to the C2 IP meet containment criteria.
These controls restrict network access and halt adversary control while preserving system RAM and forensic log data.
3
Filter out actions associated with subsequent incident response phases.
Re-imaging the host (Eradication/Recovery) and holding a review session (Lessons Learned) are recognized as premature.
Executing recovery or lessons-learned tasks during containment leaves active threats unconstrained or destroys essential evidence.

Key Concept

Incident Response Process - Containment Phase Execution
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic