Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst receives a high-priority alert indicating that an employee workstation is actively encrypting local files and attempting outbound communication with a malicious command-and-control server. According to standard incident response procedures, which of the following steps should the analyst perform FIRST?

  1. Disconnect the workstation from the local network to isolate the threat.Answer
  2. B
    Reimage the workstation using a standard enterprise baseline image.
  3. C
    Schedule a lessons-learned meeting with the incident response team.
  4. D
    Deploy an emergency patch across all enterprise endpoints to remediate the flaw.

Answer

Disconnect the workstation from the local network to isolate the threat.
Isolating the workstation from the network is the critical first step during the containment phase of incident response. Disconnecting network access halts communication with command-and-control servers and prevents lateral movement to other enterprise endpoints.

Step-by-Step Solution

1
Determine the current phase of the incident response lifecycle.
The scenario describes an active malware infection requiring immediate containment.
An ongoing incident must be contained immediately to limit scope and prevent further damage.
2
Select the appropriate action for host containment.
Isolating the system from the network halts command-and-control traffic and stops lateral propagation.
Network disconnection prevents the spread of ransomware/malware while leaving system state intact for initial analysis.

Key Concept

Incident Response Containment Phase
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic