Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

Following the detection and initial triage of an active web shell exploit on an enterprise web server, a Security Operations Center (SOC) analyst must execute the incident response playbook. Arrange the following operational response procedures in the correct chronological sequence according to standard NIST incident response lifecycle guidelines, from the earliest action to the final action.

  1. 1Perform host-level containment by moving the web server to an isolated sandbox VLAN to prevent lateral movement while preserving volatile RAM for digital forensics.
  2. 2Execute eradication procedures by removing web shell artifacts, revoking compromised service account credentials, and applying the software patch for the exploited vulnerability.
  3. 3Initiate recovery operations by restoring system software from a clean, verified baseline backup, validating secure functionality, and returning the server to production under enhanced monitoring.
  4. 4Conduct post-incident activities by holding a formal lessons-learned meeting, finalizing the incident documentation, and updating threat detection playbooks.

Answer

The correct chronological sequence of incident response actions is: 1) Perform host-level containment by isolating the web server to a sandbox VLAN, 2) Execute eradication procedures by purging malicious artifacts and patching vulnerabilities, 3) Initiate recovery operations by restoring system software from a verified baseline and resuming production traffic, and 4) Conduct post-incident activities by documenting lessons learned and updating playbooks.
Standard incident response frameworks (NIST SP 800-61 and ISO 27035) dictate a strict sequence: Containment -> Eradication -> Recovery -> Post-Incident Activity. First, the affected asset must be isolated (containment) to stop lateral movement and C2 traffic while preserving volatile evidence. Second, malicious artifacts (web shell) and vulnerabilities must be removed (eradication). Third, systems are rebuilt and reintegrated into production (recovery). Finally, post-incident activities analyze root causes and update IR playbooks.

Step-by-Step Solution

1
Identify the immediate priority post-detection: Containment.
Containment limits adversary expansion; isolation to a quarantine VLAN halts lateral movement while preserving volatile evidence.
According to NIST SP 800-61, containment must precede eradication to ensure the attacker cannot pivot or deploy destructive counter-measures during cleanup.
2
Identify the remediation phase: Eradication.
Eradication removes threat components (web shell) and remediates underlying vulnerabilities (patch application, credential revocation).
Eradication ensures that the host and network environment are fully cleaned of malicious artifacts before attempting service restoration.
3
Identify the operational restoration phase: Recovery.
Recovery restores clean configurations, reinstates production connectivity, and applies targeted monitoring.
Restoration to production can only safely occur once eradication of the threat vector and vulnerability remediation are confirmed.
4
Identify the evaluation and closure phase: Post-Incident Activity.
Lessons learned are documented, and security playbooks are updated based on incident metrics.
Post-incident analysis ensures long-term security posture enhancements and satisfies compliance requirements after system recovery.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases (Containment -> Eradication -> Recovery -> Post-Incident Activity)
Estimated Time:2m 0s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic