During a routine security audit of a branch facility, automated network telemetry alerts the security team to an unrecognized hardware tap connected to an unmonitored wall jack in a visitor conference room. The device is actively establishing an outbound covert encrypted tunnel to an external command-and-control server while performing stealthy ARP scanning across the local corporate subnet. According to standard incident response playbooks, which of the following actions should the incident response team take FIRST during the containment phase? (Select TWO.)
- Administratively disable the specific network switch port connected to the conference room wall jack to halt active lateral scanning and C2 traffic.Answer
- Capture volatile network traffic samples and memory artifacts from the active connection prior to physically disconnecting or powering down the device.Answer
- CRe-image the firmware of all core switches across the branch network to eradicate potential persistent rootkits.
- DImplement a broad firewall rule blocking all outbound TLS/SSL port 443 connections across the enterprise network.
Answer
The incident response team should administratively disable the specific switch port linked to the unauthorized device and capture volatile memory and network traffic artifacts before physically disconnecting the hardware.
Targeted containment of an active hardware threat requires immediate isolation of its network interface (disabling the switch port) to halt C2 activity and lateral movement, combined with non-destructive volatile evidence capture (network traffic and memory dumps) prior to physical device intervention.
Step-by-Step Solution
Key Concept
Incident Response Containment Strategy & Evidence Preservation