Examkin

Question

Difficulty: Very hardIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst detects anomalous outbound network traffic originating from an automated CI/CD build worker node. Telemetry confirms that a compromised runner script exfiltrated temporary cloud provider authentication tokens to an external command-and-control server and is currently reading production database credentials stored in secret memory. According to the NIST incident response lifecycle guidelines (SP 800-61), which of the following actions should the analyst execute FIRST?

  1. Revoke the exposed access token and isolate the affected CI/CD runner host from the network.Answer
  2. B
    Terminate and re-image the compromised runner instance to remove any malicious code.
  3. C
    Modify the pipeline configuration repository to patch the vulnerability in the runner script.
  4. D
    Conduct a post-incident review to update the CI/CD pipeline security playbook.

Answer

Revoke the exposed access token and isolate the affected CI/CD runner host from the network.
According to NIST SP 800-61 incident response guidelines, once an active incident is detected, the analyst's immediate priority is Containment. Revoking active compromised credentials and network-isolating the runner host prevents ongoing exfiltration and lateral movement.

Step-by-Step Solution

1
Identify the current phase of incident response
The incident has been detected and confirmed; the response enters the Containment, Eradication, and Recovery phase, specifically starting with Containment.
Immediate containment limits the scope of damage and prevents active exfiltration.
2
Determine the prioritized containment steps
Isolating the infected node and revoking compromised tokens stops network exfiltration and invalidates stolen credentials immediately.
Credentials and network access must be neutralized before persistent access can be established elsewhere.
3
Differentiate containment actions from eradication and post-incident actions
Re-imaging (eradication), patching (corrective control), and playbook updates (post-incident lessons learned) must occur only after containment is achieved.
Executing eradication or post-incident steps prematurely leaves active vectors uncontained.

Key Concept

Incident Response Lifecycle Phase Ordering and Containment Strategies
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic