Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst receives a high-severity alert showing that an automated ransomware script is actively executing on an enterprise endpoint and encrypting shared network folders. The analyst confirms the active file encryption via endpoint telemetry. According to standard incident response frameworks, which of the following actions should the analyst take FIRST?

  1. Isolate the compromised endpoint from the network by disabling its network adapter.Answer
  2. B
    Reimage the system hard drive and restore files from the most recent offline backup.
  3. C
    Modify enterprise group policies to prevent PowerShell script execution across all domain workstations.
  4. D
    Convene an incident response review meeting with executive leadership to complete a lessons-learned report.

Answer

Isolate the compromised endpoint from the network by disabling its network adapter.
In accordance with standard incident response playbooks (such as NIST SP 800-61), containment must occur immediately after an active incident is confirmed to prevent further damage or data loss. Isolating the infected host from the network stops the ransomware from communicating with Command & Control (C2) servers and encrypting additional network resources while preserving the system state for forensic investigation.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
The scenario describes an ongoing attack actively spreading across network shares (Detection & Analysis moving into Containment).
Determining the correct phase ensures actions follow the NIST/ISO Incident Response Life Cycle.
2
Determine the primary immediate objective during active ransomware propagation.
The immediate objective is containment—stopping the ransomware from reaching additional hosts or shared drives.
Containment limits the scope and blast radius of the security incident.
3
Select the option that achieves immediate containment without destroying volatile forensic evidence.
Network isolation stops network activity while leaving volatile system memory intact for analysis.
Network isolation is the standard first containment step in playbooks for active network-aware malware.

Key Concept

Incident Response Lifecycle Phases and Containment Strategy
Estimated Time:1m 15s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic