Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

An enterprise Security Operations Center (SOC) identifies anomalous database queries originating from an authenticated SSL/TLS VPN remote user session outside of normal business hours. Place the following incident response actions in the correct chronological order from first step to last step according to the standard NIST Incident Response Lifecycle.

  1. 1Analyze VPN access logs and correlate SIEM alerts to confirm the scope of compromise and validate indicators of threat actor activity.
  2. 2Terminate active VPN sessions associated with the compromised account and isolate connected database servers from the internal network.
  3. 3Revoke compromised user credentials, remove persistence mechanisms created by the adversary, and patch identified VPN gateway vulnerabilities.
  4. 4Restore affected database tables from verified clean backups and safely re-enable user remote access with mandatory multi-factor authentication resets.
  5. 5Conduct a post-incident review meeting with stakeholders to document the incident timeline, evaluate team response, and update incident playbooks.

Answer

The correct chronological sequence according to the NIST Incident Response Lifecycle is: 1. Analyze logs and correlate alerts (Detection and Analysis), 2. Terminate VPN sessions and isolate database servers (Containment), 3. Revoke compromised credentials and remove persistence mechanisms (Eradication), 4. Restore systems from clean backups and enforce MFA reset (Recovery), and 5. Conduct a post-incident review meeting to update playbooks (Post-Incident Activity).
Standard incident response frameworks (such as NIST SP 800-61 Rev. 2) define a sequential lifecycle: Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. Security teams must first validate indicators to establish scope (Detection & Analysis), immediately restrict attacker access and isolate affected assets (Containment), eliminate threat artifacts and vulnerabilities (Eradication), restore systems to production under secure conditions (Recovery), and finally document lessons learned to improve playbooks (Post-Incident Activity).

Step-by-Step Solution

1
Identify Detection and Analysis activities
Analyzing VPN logs and SIEM data verifies the unauthorized access and determines the scope of compromise.
Responders must validate that a security incident has occurred and understand its footprint prior to executing operational containment.
2
Identify Containment activities
Terminating active connections and isolating hosts halts active malicious actions and prevents network spread.
Containment limits operational damage while security personnel plan and execute permanent threat eradication.
3
Identify Eradication activities
Revoking compromised tokens, removing backdoor mechanisms, and applying security patches eliminates the adversary's presence.
Eradication removes the root cause so affected hosts can be re-introduced to production safely.
4
Identify Recovery activities
Restoring database systems from known-good backups and re-enabling access brings business operations back online.
Recovery validates system integrity and resumes normal business capabilities under enhanced monitoring.
5
Identify Post-Incident Activity
Conducting a debrief session and updating playbooks documents response efficacy and lessons learned.
Post-incident review improves operational readiness and updates incident response playbooks for future events.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Estimated Time:1m 30s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic