Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

During an ongoing incident, a security analyst discovers that an internal web application service account was compromised and is actively attempting unauthorized Kerberoasting attacks to extract Active Directory ticket-granting service hashes. According to standard NIST incident response frameworks, which of the following actions should the incident response team perform FIRST during the containment phase?

  1. Disable the compromised service account and isolate the host hosting the web application from the internal network.Answer
  2. B
    Re-image the Active Directory Domain Controller operating system to ensure all malicious session tickets are completely destroyed.
  3. C
    Deploy an inline intrusion detection system (IDS) sensor on the domain subnet to monitor for secondary credential harvesting attempts.
  4. D
    Purge all SQL injection logs from the web server to prevent worm self-replication across connected subnets.

Answer

Disable the compromised service account and isolate the host hosting the web application from the internal network.
The correct response prioritizes immediate containment by disabling the compromised credentials and isolating the compromised host from the network. In the NIST incident response lifecycle, containment must occur before eradication or recovery to prevent the adversary from expanding their breach footprint across the domain.

Step-by-Step Solution

1
Identify the phase of the incident response lifecycle required by the scenario.
The scenario requires an immediate action in the Containment phase of the NIST incident response framework.
Containment focuses on limiting the scope and impact of an active breach to prevent lateral movement and further unauthorized access.
2
Evaluate potential containment mechanisms for credential abuse and host compromise.
Disabling the affected service account revokes access, and isolating the host isolates the attack source.
Combining account disablement and host network isolation stops both credential-based lateral movement and host-based communications.
3
Distinguish containment actions from eradication, recovery, or detective controls.
Re-imaging belongs to eradication/recovery, passive monitoring is detective, and log purging destroys forensic evidence.
Proper IR playbooks require stopping the breach (containment) before conducting full cleanup (eradication) or restoration (recovery).

Key Concept

Incident Response Containment Phase Execution
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic