Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

A security analyst monitoring a Security Information and Event Management (SIEM) dashboard receives an alert showing an internal web application server actively executing unauthorized PowerShell scripts launched via a web shell. The web shell was uploaded through a newly exploited file upload vulnerability. According to standard incident response playbooks, which of the following should be the analyst's immediate next action?

  1. Disconnect the affected web server from the network segment while maintaining host power.Answer
  2. B
    Re-image the server operating system and restore files from the most recent clean backup.
  3. C
    Deploy a signature update to the Web Application Firewall to block cross-site scripting payloads.
  4. D
    Conduct a post-incident review meeting to update the organization's incident response policy.

Answer

Disconnect the affected web server from the network segment while maintaining host power.
In accordance with standard NIST/ISO incident response frameworks, once an active compromise is confirmed, the immediate priority is containment. Isolating the server from the network stops active command-and-control channels and lateral movement while keeping the system powered on to preserve volatile RAM evidence for forensic capture.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
An active compromise (web shell executing unauthorized commands) is verified, requiring immediate containment.
Containment limits the scope of damage and prevents the attacker from escalating privileges or moving laterally.
2
Select the appropriate containment technique that preserves forensic evidence.
Network isolation detaches the host from the corporate network without powering off the machine.
Maintaining system power ensures volatile data stored in RAM remains available for digital forensics.

Key Concept

Incident Response Lifecycle - Containment Phase
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic