Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

During off-hours monitoring, a security operations analyst identifies an active, unauthorized bulk exfiltration of sensitive personnel records from an internal HR database server to an external IP address via a compromised service account. The analyst has confirmed that the exfiltration is actively taking place. According to standard incident response lifecycle guidelines, which of the following actions should the analyst take FIRST?

  1. Disable the compromised service account and temporarily isolate the HR database server from the network.Answer
  2. B
    Restore the HR database server from the most recent validated clean backup image.
  3. C
    Deploy a honeypot inside the database network segment to monitor the attacker's operational tactics.
  4. D
    Apply web application firewall rules to inspect and sanitize incoming SQL injection string payloads.

Answer

Disable the compromised service account and temporarily isolate the HR database server from the network.
When an active incident involving data exfiltration is detected, the immediate priority in the NIST/ISO incident response process is Containment. Disabling the hijacked service account and network-isolating the affected host stops the ongoing unauthorized data transfer instantly and prevents the attacker from moving laterally.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
The incident is actively occurring (data exfiltration in progress), placing the team in the Containment phase of the NIST SP 800-61 IR lifecycle.
The primary objective during an active breach is limiting the scope of damage and preventing further data loss.
2
Evaluate containment actions against other lifecycle phases.
Disabling the compromised credential and segmenting the host stops the active transfer immediately.
Eradication and recovery steps (like restoring backups) must wait until containment is complete to prevent reinfection or continued exfiltration.

Key Concept

Incident Response Lifecycle - Containment Phase
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic