Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

An Incident Response Team (IRT) responds to a active command-and-control (C2) beaconing alert on a critical internal database server. Place the following incident response actions in the correct sequential order according to the standard NIST SP 800-61 incident response lifecycle, starting with the earliest action.

  1. 1Isolate the compromised database server from the internal network segment.
  2. 2Capture volatile RAM state and system memory dumps from the isolated system.
  3. 3Remove the threat actor's malware binaries, webshells, and unauthorized persistence hooks.
  4. 4Restore database applications from a verified clean backup and monitor traffic in production.
  5. 5Convene a lessons-learned session with key stakeholders to update incident playbooks.

Answer

The correct sequential sequence follows the NIST SP 800-61 lifecycle: Network Isolation (Containment) -> Volatile Memory Capture (Evidence Preservation) -> Malware/Persistence Removal (Eradication) -> Clean Backup Restoration (Recovery) -> Lessons-Learned Session (Post-Incident Activity).
Under NIST SP 800-61, incident response progresses strictly through Containment (network isolation), Forensic Evidence Preservation (memory acquisition), Eradication (malware and backdoor removal), Recovery (system restoration from clean backups), and Post-Incident Activity (lessons learned review).

Step-by-Step Solution

1
Execute initial containment by disconnecting the host from the network
Stops active C2 communications and prevents lateral movement.
Containment limits incident scope and stops ongoing damage immediately.
2
Preserve volatile evidence
Obtains volatile RAM and process state while the system remains intact.
Evidence collection must occur before system modifications corrupt forensic artifacts.
3
Perform system eradication
Removes malicious software, persistence mechanisms, and compromise artifacts.
Eradication ensures the adversary cannot re-establish control once restored.
4
Execute operational recovery
Restores database operations from known-good backups and reinstates production status under heightened monitoring.
Recovery safely returns services to production after confirming eradication.
5
Conduct post-incident review (lessons learned)
Identifies root cause, updates playbooks, and addresses operational gaps.
Post-incident analysis improves organizational resilience against future incidents.

Key Concept

NIST SP 800-61 Incident Response Lifecycle
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic