Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

A security analyst confirms that an employee workstation has been infected with self-propagating malware that is actively scanning the local subnet for vulnerable hosts. According to standard incident response frameworks, which action should the analyst take FIRST?

  1. Disconnect the workstation from the network to isolate itAnswer
  2. B
    Reimage the workstation's hard drive to completely remove the malware
  3. C
    Restore the workstation files from the latest secure offline backup
  4. D
    Convene a post-incident review meeting to document lessons learned

Answer

Disconnect the workstation from the network to isolate it
Isolating the affected system from the network is the immediate containment action required by NIST and ISO incident response playbooks. Containment stops the active spread of malware and lateral movement while preserving the current state for further analysis.

Step-by-Step Solution

1
Identify the current phase of the incident response process
The incident has been detected and confirmed, meaning containment must immediately follow.
Once an active threat is identified, stopping its spread is the primary operational objective.
2
Select the containment action from the available choices
Disconnecting/isolating the host prevents network traffic from leaving or entering the infected system.
Network isolation stops active lateral movement without destroying volatile evidence needed for containment analysis.

Key Concept

Incident Response Process Order (Containment Phase First)
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic