Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During a routine audit, a Security Operations Center (SOC) analyst detects an unauthorized rogue wireless access point bridged directly into an isolated network segment containing sensitive customer databases. Forensic monitoring confirms that an external threat actor is actively exfiltrating live database traffic across this rogue wireless link. According to standard incident response lifecycle frameworks, which of the following actions should the incident response team perform FIRST?

  1. Disable the switch port connected to the rogue access point to isolate the wireless bridge and stop active data transfer.Answer
  2. B
    Re-image the compromised database servers and restore all system files from offline backups.
  3. C
    Deploy wireless honeypots throughout the facility to monitor and capture the threat actor's ongoing attack techniques.
  4. D
    Convene a post-incident review meeting to update enterprise wireless containment playbooks and security policies.

Answer

Disable the switch port connected to the rogue access point to isolate the wireless bridge and stop active data transfer.
According to NIST SP 800-61 and ISO/IEC 27035 frameworks, once an active breach with exfiltration is detected, the immediate priority is Containment. Disabling the physical switch port stops ongoing exfiltration over the rogue wireless bridge without altering volatile memory on the target database servers.

Step-by-Step Solution

1
Identify the current phase of the incident response lifecycle.
The incident is actively occurring with ongoing data exfiltration, placing it in the Containment, Eradication, and Recovery phase (specifically requiring immediate containment).
Before root-cause elimination or recovery can begin, active exfiltration must be halted to limit damage.
2
Select the immediate containment control.
Disabling the physical switch port supporting the rogue access point immediately isolates the unauthorized device from the internal network.
Network link suppression isolates the attacker's exfiltration pathway while preserving volatile memory and system logs on the database server for forensic analysis.

Key Concept

Incident Response Lifecycle - Containment Strategy
Estimated Time:2m 0s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic