Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst detects an active exfiltration attempt where an unauthorized external IP address is utilizing a compromised cloud API key to download sensitive data. Place the following incident response playbook actions in the correct sequential order from FIRST to LAST.

  1. 1Revoke the compromised API key and block the malicious external IP address.
  2. 2Perform a forensic analysis of cloud audit logs to identify all accessed resources and exfiltrated files.
  3. 3Eliminate residual attacker access mechanisms and restore secure configurations across affected accounts.
  4. 4Conduct a post-incident lessons learned session to document findings and improve detection rules.

Answer

The correct sequence is: First, revoke the compromised API key and block the malicious external IP address (Containment). Second, perform a forensic analysis of cloud audit logs to identify accessed resources (Analysis). Third, eliminate residual attacker access mechanisms and restore secure configurations (Eradication & Recovery). Fourth, conduct a post-incident lessons learned session (Post-Incident Activity).
The correct order follows the standard incident response process: initial Containment (revoking keys/blocking IPs to stop active loss), followed by Analysis (scoping exfiltrated files and attack footprint), Eradication & Recovery (removing persistence mechanisms and restoring secure configurations), and concluding with Post-Incident Activity (lessons learned and playbook updates).

Step-by-Step Solution

1
Implement Containment Controls
Ongoing data exfiltration is immediately halted, preventing additional loss.
Containment must occur first during an active exfiltration event to limit organizational damage.
2
Conduct Forensic Investigation and Analysis
The full scope of exfiltrated data and affected cloud infrastructure is identified.
Analyzing logs immediately post-containment ensures all compromised assets are accounted for.
3
Execute Eradication and System Recovery
Attacker persistence is removed and systems are safely restored to a baseline operational state.
Eradication removes root causes while recovery validates secure operational resumption.
4
Complete Post-Incident Review (Lessons Learned)
Documentation is finalized and IR playbooks/SOC detection logic are updated.
Lessons learned occur after operational restoration to ensure continuous security enhancement.

Key Concept

Incident Response Lifecycle Sequencing (NIST SP 800-61 / ISO 27035)
Estimated Time:1m 30s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic