Examkin

Question

Difficulty: Very hardIncident Response Process and Playbooks

A security analyst investigating a cloud-hosted infrastructure detects that an OAuth 2.0 refresh token assigned to an automated microservice was compromised. Real-time monitoring confirms an unauthorized external entity is actively exploiting this token to execute bulk queries and exfiltrate sensitive financial records from a database endpoint. According to standard incident response lifecycle frameworks, which of the following represents the IMMEDIATE next step the incident response team should take?

  1. Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.Answer
  2. B
    Deploy newly compiled container images and restore backend database tables from offline clean backups.
  3. C
    Reconfigure the intrusion detection system from passive monitoring to inline network blocking to act as a primary corrective control.
  4. D
    Apply web application firewall filtering to strip malicious JavaScript tags from API payloads to prevent client-side Cross-Site Scripting against the database.

Answer

Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.
The correct response prioritizes containment above eradication and recovery during an active security incident. In standard frameworks (such as NIST SP 800-61), once an incident is detected and validated, the immediate priority is limiting the scope of impact and preventing further exfiltration. Revoking the compromised OAuth token invalidates the active credential, while temporary network isolation prevents further unauthorized API interaction.

Step-by-Step Solution

1
Analyze the current state of the security incident based on scenario telemetry.
Identified active data exfiltration occurring via a compromised OAuth token.
Determining whether an active threat is in progress dictates the immediate priority in the incident response process.
2
Determine the appropriate incident response phase according to standard NIST SP 800-61 / ISO 27035 guidelines.
The incident is actively occurring, requiring immediate Containment.
The priority during active breach scenarios is to limit damage and prevent further unauthorized data movement before initiating remediation.
3
Select the response action that fulfills the containment objective.
Revoking the compromised token and isolating the affected endpoint stops ongoing data leakage immediately.
Invalidating stolen active session/token credentials and isolating network pathways directly halts unauthorized data access without jumping ahead to eradication or recovery.

Key Concept

Incident Response Lifecycle Containment Phase Priorities
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic