Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

A security analyst is executing an incident response playbook following a confirmed malware alert on a user workstation. Which of the following actions represent appropriate steps during the containment phase of the incident response process? (Select TWO.)

  1. Disconnecting the workstation from the network by disabling its network interfaceAnswer
  2. Applying temporary ACLs at the perimeter firewall to block outbound communication to known malicious IP addressesAnswer
  3. C
    Reimaging the infected system's hard drive using a standard gold master image
  4. D
    Holding a post-incident review session with the incident response team to update playbook documentation

Answer

The appropriate containment steps are disconnecting the workstation from the network by disabling its network interface and applying temporary firewall ACLs to block outbound communication to malicious command-and-control servers.
During the containment phase of incident response, the main priority is stopping the spread of the attack and limiting its impact. Disabling the local network interface isolates the system from internal network assets, stopping lateral movement. Blocking outbound traffic to command-and-control IP addresses prevents ongoing data exfiltration and remote attacker control.

Step-by-Step Solution

1
Determine the primary objective of the containment phase
Containment focuses on restricting the impact of an incident and preventing further damage or propagation.
Isolating infected systems and blocking active attack vectors stops the incident from spreading while preserving evidence for investigation.
2
Evaluate response actions against incident response phases
Disabling network connectivity and blocking command-and-control traffic directly restrict threat movement, fitting containment. Reimaging systems belongs to eradication/recovery, and reviewing playbooks belongs to post-incident activities.
Executing eradication or post-incident actions out of order can disrupt evidence collection or leave active threats uncontained.

Key Concept

Incident Response Containment Actions
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic