Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

A security analyst discovers that a developer's API key was publicly exposed in a code repository and is actively being used by an unauthorized external entity to read data from a cloud storage bucket. According to standard incident response playbooks, which of the following immediate CONTAINMENT steps should the analyst take? (Select TWO.)

  1. Revoke or disable the compromised API key immediately to terminate unauthorized access.Answer
  2. Apply an explicit firewall or security group rule to block traffic from the attacker's external IP address.Answer
  3. C
    Conduct a post-incident lessons learned meeting to discuss repository secret-scanning procedures.
  4. D
    Completely rebuild and re-image the enterprise identity provider server infrastructure.

Answer

The analyst should immediately revoke the compromised API key and block the attacker's external IP address.
During the containment phase of the incident response lifecycle, the primary goal is to prevent further exposure and stop active malicious activity. Revoking the exposed API key immediately invalidates the attacker's authentication material, while blocking the malicious IP address prevents further inbound traffic from that vector.

Step-by-Step Solution

1
Identify the immediate containment objective
Determine that active data access via the stolen credential must be stopped without delay.
Containment limits the scope and impact of an active incident before proceeding to eradication.
2
Select appropriate containment controls
Disabling the compromised API key invalidates the authentication token, and blocking the source IP mitigates incoming request traffic.
These actions stop the attack vector immediately while preserving system availability for non-compromised services.

Key Concept

Incident Response Containment Phase
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic