Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

A security analyst detects active data exfiltration originating from a compromised database server. Which of the following incident response steps should be taken first?

  1. Isolate the affected server from the network to stop the data transfer.Answer
  2. B
    Reformat the hard drives and reinstall the operating system.
  3. C
    Restore the database contents from a known clean backup baseline.
  4. D
    Hold a lessons learned meeting to review security incident documentation.

Answer

Isolate the affected server from the network to stop the data transfer.
Isolating the affected server immediately contains the active incident by terminating ongoing exfiltration channels and preventing lateral movement across the internal network.

Step-by-Step Solution

1
Identify the current state of the security incident from the scenario.
An attack is actively occurring (data exfiltration in progress).
Active threats require immediate containment to limit damage and prevent further exfiltration.
2
Map the candidate actions to standard incident response lifecycle phases.
Isolating the host belongs to Containment, formatting belongs to Eradication, restoring belongs to Recovery, and reviewing belongs to Post-Incident Activity.
Standard NIST incident response guidelines dictate performing Containment prior to Eradication, Recovery, or Post-Incident activities.

Key Concept

Incident Response Lifecycle Order
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic