Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

A security analyst confirms that an internal user workstation is infected with active malware that is attempting to communicate with an external command-and-control server. According to standard incident response lifecycle frameworks (such as NIST SP 800-61), which of the following actions should the analyst take immediately after confirming the incident?

  1. Isolate the compromised workstation from the local network segment.Answer
  2. B
    Re-image the workstation hard drive to remove all malicious files.
  3. C
    Restore missing user data files from the most recent secure backup.
  4. D
    Schedule a lessons-learned meeting with key business stakeholders.

Answer

Isolate the compromised workstation from the local network segment.
Isolating the affected system from the network is the essential initial containment step. It prevents lateral movement and external command-and-control communication while preserving system state for analysis.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle.
The incident has just been confirmed during the Detection and Analysis phase.
Determining the current phase dictates the appropriate immediate objective.
2
Determine the next sequential phase in standard frameworks (such as NIST SP 800-61).
The immediate next phase is Containment, Eradication, and Recovery, beginning with Containment.
Containment limits the scope of damage and prevents the malware from spreading or exfiltrating data.
3
Select the action corresponding to containment.
Network isolation of the host isolates the threat while allowing further analysis.
Isolating the workstation stops network transmission without destroying volatile forensic evidence on the host.

Key Concept

Incident Response Lifecycle Phase Order (NIST SP 800-61)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic