Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

During routine monitoring, a Security Operations Center (SOC) team detects an active Command and Control (C2) session originating from an internal workstation following the execution of an unauthorized payload. Security logs indicate the compromised host is attempting lateral reconnaissance against neighboring internal subnets. According to standard incident response frameworks, which of the following actions should the incident response team perform FIRST?

  1. Isolate the compromised workstation from the network using endpoint containment controlsAnswer
  2. B
    Re-image the workstation operating system using a clean baseline image
  3. C
    Conduct a post-incident lessons learned review to update incident response playbooks
  4. D
    Reconfigure perimeter firewalls to convert existing logging rules into active blocking controls

Answer

Isolate the compromised workstation from the network using endpoint containment controls
In standard incident response frameworks (such as NIST SP 800-61), once an incident is identified, the immediate priority is Containment. Isolating the compromised host from the network stops active Command and Control (C2) communication and prevents lateral movement to other internal systems before eradication and recovery steps take place.

Step-by-Step Solution

1
Determine the current stage of the incident response lifecycle
The incident has been confirmed and active threat activity (C2 traffic and lateral movement) is identified.
Identifying the current phase determines the next mandatory action under NIST SP 800-61 frameworks.
2
Identify the immediate next lifecycle phase
The phase directly following Identification is Containment.
Containment limits the scope of damage and prevents further propagation of the compromise.
3
Select the appropriate containment procedure
Execute host-level isolation of the compromised endpoint.
Disconnecting the endpoint from the network isolates the threat without destroying volatile memory needed for evidence collection.

Key Concept

Incident Response Process and Playbooks - Containment Phase Execution
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic