Examkin

Question

Difficulty: Very hardIncident Response Process and Playbooks

Following the detection of suspicious command-and-control beaconing, an enterprise incident response team completes short-term network isolation of a compromised hypervisor host managing critical cloud workloads. The analyst verifies that lateral movement has been halted and containment boundaries are holding. According to standard NIST incident response lifecycle guidelines, which action should the incident response team execute NEXT before initiating eradication procedures?

  1. Acquire volatile memory dumps and cryptographic forensic images of the host to preserve digital evidence.Answer
  2. B
    Immediately purge rogue persistence mechanisms, malicious services, and compromised administrative accounts.
  3. C
    Rebuild the hypervisor cluster from golden images and restore guest workloads from offline backups.
  4. D
    Deploy network intrusion prevention signature updates as the primary corrective control to eliminate host malware.

Answer

Acquire volatile memory dumps and cryptographic forensic images of the host to preserve digital evidence.
Under NIST SP 800-61 (Handling Computer Security Incidents), once an infected host is isolated to contain an incident, the team must preserve volatile memory (RAM) and generate forensic disk images before modifying host state. This ensures digital evidence is retained for root-cause analysis and potential legal proceedings prior to starting eradication.

Step-by-Step Solution

1
Identify the current phase in the NIST SP 800-61 Incident Response Lifecycle.
The scenario states that short-term network containment has just been successfully established.
Understanding the precise boundary within the Containment, Eradication, and Recovery phase dictates the sequential next step.
2
Determine the necessary sub-step prior to system modification or remediation.
Preserving volatile artifacts (RAM) and acquiring forensic disk images must occur while the system remains isolated.
Executing eradication or rebooting the host before memory acquisition destroys volatile evidence critical for forensic root-cause analysis.
3
Select the option aligned with evidence retention within the containment phase.
Capturing volatile memory and disk forensic images is the correct immediate action.
This maintains chain of custody and adheres to NIST IR playbook sequence rules.

Key Concept

NIST Incident Response Lifecycle (Containment & Evidence Preservation Order)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic