Examkin

Question

Difficulty: Very hardIncident Response Process and Playbooks

An incident response analyst confirms that an on-premises virtual machine hosting a critical enterprise database is actively communicating with a known malicious external C2 server and executing an unauthorized encryption routine on local volumes. What is the immediate next step the analyst should take in accordance with standard incident response playbooks?

  1. Isolate the virtual machine from the network segment while maintaining system power to preserve volatile memory artifacts.Answer
  2. B
    Restore the database files and system state directly from the most recent immutable backup vault.
  3. C
    Power down the host hypervisor and reformat all attached storage volumes containing encrypted files.
  4. D
    Reconfigure the perimeter firewall to inspect and block cross-site scripting (XSS) reflection vectors.

Answer

Isolate the virtual machine from the network segment while maintaining system power to preserve volatile memory artifacts.
Under standard incident response lifecycle frameworks, containment is the mandatory immediate phase once an active threat is identified. Isolating the virtual machine at the network layer stops command-and-control communications and prevents lateral movement across the enterprise network. Maintaining system power ensures volatile memory (RAM) is preserved for forensic collection.

Step-by-Step Solution

1
Identify the active incident response phase
The incident is actively occurring with active malicious beaconing and volume encryption.
Active threats require immediate containment under NIST SP 800-61 guidelines.
2
Perform host containment while preserving forensic evidence
Disconnect network access to the virtual machine without turning off power.
Network isolation prevents lateral movement and exfiltration while preserving volatile RAM data.
3
Defer eradication and recovery until containment is complete
Avoid premature restoration or host destruction.
Executing eradication or recovery while active C2 sessions exist leads to re-compromise.

Key Concept

Incident Response Lifecycle Phase Order and Host Isolation
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic