Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During off-hours monitoring, a Security Operations Center (SOC) analyst detects an unauthorized PowerShell script executing on an internal domain-joined workstation. EDR telemetry confirms the script is actively performing Kerberoasting by requesting Service Principal Name (SPN) tickets with weak RC4 encryption across the internal subnet to prepare for offline password cracking. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform FIRST?

  1. Isolate the compromised workstation from the network using host-level isolation controls.Answer
  2. B
    Reset the passwords of all target service accounts across Active Directory.
  3. C
    Re-image the workstation operating system using a clean baseline backup image.
  4. D
    Reconfigure the edge firewall to block all inbound HTTP traffic to the domain controller.

Answer

Isolate the compromised workstation from the network using host-level isolation controls.
In standard incident response frameworks (such as NIST SP 800-61), once an active threat is detected on a system, the immediate priority is Containment. Disconnecting or isolating the compromised endpoint from the network stops the ongoing Kerberoasting attack from reaching other Domain Controllers or pivoting laterally across the internal subnet, while keeping the machine powered on for volatile memory capture.

Step-by-Step Solution

1
Analyze the incident lifecycle stage based on the SOC telemetry.
The incident is currently in the active execution/containment phase where an internal endpoint is performing unauthorized credential harvesting.
Before performing remediation or forensic cleanup, active spread and communication must be halted.
2
Determine the mandatory initial response phase per NIST SP 800-61 incident response guidelines.
Containment must take precedence over eradication and recovery.
Failing to contain the active host allows the attacker to continue harvesting tickets or pivot deeper into the enterprise network.
3
Select the action that achieves effective host containment without destroying immediate evidence or jumping to eradication.
Endpoint network isolation prevents lateral movement while allowing volatile memory to remain intact for investigation.
Host-level EDR isolation disconnects network interfaces while keeping the machine running for live memory forensics.

Key Concept

Incident Response Containment Phase Prioritization
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic