Examkin

Question

Difficulty: Very hardIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst detects anomalous activities in an enterprise cloud environment. An unknown adversary compromised a privileged user account via session hijacking and registered a malicious OAuth application to maintain persistent access. The attacker is currently executing automated API requests to enumerate and exfiltrate sensitive cloud storage buckets. According to NIST incident response guidelines, which of the following actions should the analyst execute during the CONTAINMENT phase to restrict the threat while preserving forensic evidence? (Select TWO.)

  1. Revoke all active OAuth refresh tokens and session keys associated with the compromised user account and malicious application.Answer
  2. Apply an inline access control rule or Conditional Access policy to block requests originating from the adversary's command-and-control (C2) IP ranges.Answer
  3. C
    Delete the compromised cloud tenant identity store and re-federate the directory service using a baseline deployment template.
  4. D
    Permanently remove the malicious OAuth application registration and clear the tenant API audit logs to eliminate attacker persistence.

Answer

The correct containment actions are revoking active OAuth tokens/sessions and applying conditional access rules to block the adversary's C2 IP addresses.
During the containment phase, the primary objective is to limit the scope of an incident and stop active adversary operations while maintaining forensic integrity. Revoking active OAuth refresh tokens/session keys cuts off API access immediately, while applying network filtering rules against known command-and-control IP addresses stops data exfiltration without modifying forensic artifacts.

Step-by-Step Solution

1
Analyze the incident phase requirements based on NIST SP 800-61 Rev. 2 framework.
The current task requires identifying actions specific to Containment, which isolates affected resources and prevents further damage without destroying forensic evidence.
Containment must precede eradication and recovery to stop ongoing threat activity while retaining environment state for analysis.
2
Evaluate token revocation and conditional access policy enforcement.
Revoking OAuth sessions immediately stops API access, and blocking C2 IP ranges prevents network communication.
Both steps contain the adversary's active access vectors cleanly without tampering with historic security logs or tenant artifacts.
3
Evaluate the incorrect options regarding evidence destruction and phase ordering.
Deleting identity stores or clearing audit logs disrupts forensic investigation and jumps out of sequence into eradication/recovery.
Log deletion destroys digital evidence and tenant redeployment is a recovery phase operation.

Key Concept

Incident Response Containment Phase Strategies and Evidence Preservation
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic