Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During an incident response investigation, a Security Operations Center (SOC) team detects an active web shell on a public-facing web server cluster. Log telemetry confirms that the threat actor is abusing harvested service account credentials to attempt lateral movement toward the enterprise database tier. According to standard incident response lifecycle frameworks, which of the following containment actions should the Incident Response Team (IRT) execute immediately? (Select TWO.)

  1. Revoke the compromised service account credentials and terminate all active authentication sessions in the identity provider.Answer
  2. Isolate the compromised web server cluster from the internal network using firewall rules and host microsegmentation.Answer
  3. C
    Immediately format the web server storage drives and restore system files from clean backup images.
  4. D
    Deploy an updated Web Application Firewall (WAF) signature to filter incoming Cross-Site Scripting (XSS) request headers.

Answer

The correct containment actions are revoking the compromised service account credentials and isolating the compromised web server cluster from the internal network using microsegmentation.
In accordance with standard incident response playbooks, containment aims to halt the spread of an active compromise while preserving evidence. Disabling compromised service account credentials neutralizes the adversary's authentication access, while network microsegmentation isolates the web server cluster to prevent lateral movement to database assets.

Step-by-Step Solution

1
Determine the current phase of the incident response lifecycle.
The incident is currently in the Containment phase following active detection of a web shell and attempted lateral movement.
Containment limits incident impact and prevents lateral expansion before moving to eradication.
2
Identify effective containment controls that preserve evidence.
Revoking compromised account tokens blocks authorized access abuse, and microsegmenting network paths blocks traffic to internal database servers.
These controls stop attacker activity without overwriting system volatile memory or storage logs.
3
Differentiate containment actions from eradication or preventive controls.
System reimaging is classified under eradication/recovery, while WAF signature updates represent preventive controls.
Executing eradication prior to containment breaches standard NIST/ISO IR lifecycle sequence.

Key Concept

Incident Response Containment Phase Execution
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic