Examkin

Question

Difficulty: Very hardIncident Response Process and Playbooks

During a active security incident, a enterprise Security Operations Center (SOC) team detects that an attacker has gained persistence on an internal domain-joined SQL database server containing highly sensitive PII. Forensics logs reveal the attacker established a reverse shell via a web application vulnerability and is currently conducting live internal network scanning and attempting lateral movement via Server Message Block (SMB). According to the NIST Incident Response Framework (SP 800-61 Rev. 2), which of the following actions should the incident response team perform IMMEDIATELY as part of the Containment phase? (Select TWO.)

  1. Apply host-based firewall rules to block inbound and outbound traffic on the affected SQL server while preserving established network connections for memory dump acquisition.Answer
  2. Isolate the compromised database service account by temporarily disabling it in Active Directory and revoking active Kerberos ticket granting tickets (TGTs).Answer
  3. C
    Perform a complete system re-image of the SQL server using a known-good baseline image and restore database tables from offsite backup tapes.
  4. D
    Conduct a post-mortem review meeting with stakeholders to update automated Security Orchestration, Automation, and Response (SOAR) playbooks.

Answer

The incident response team should apply host-based firewall rules to isolate network traffic while preserving memory for forensic preservation, and disable the compromised Active Directory service account while revoking active session tokens.
Isolating network traffic through host firewall rules and revoking compromised credentials directly contain the adversary's lateral movement and active sessions while protecting volatile RAM for memory forensics.

Step-by-Step Solution

1
Identify current incident phase
The incident is actively occurring; active lateral movement and C2 require immediate containment actions.
Containment limits the scope of damage and prevents further adversary access while volatile evidence is collected.
2
Select appropriate containment controls
Host isolation via firewall controls stops lateral movement, and disabling compromised credentials prevents ongoing session abuse.
These actions contain the threat without altering volatile system memory needed for forensic evaluation.
3
Evaluate and filter out-of-order phase actions
Re-imaging systems belongs to Eradication/Recovery, while post-mortem reviews belong to Post-Incident Activity.
Prematurely executing eradication or lessons learned violates NIST lifecycle sequence rules.

Key Concept

NIST Incident Response Lifecycle (Containment Strategy and Phase Sequencing)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic