Examkin

Question

Difficulty: Very hardIncident Response Process and Playbooks

During security monitoring, a enterprise Security Operations Center (SOC) team identifies unauthorized API requests executed using a compromised service account token within a production container orchestration cluster. Threat intelligence logs reveal that the attacker has already spawned rogue workload pods designed to perform network reconnaissance and attempt lateral movement toward an isolated sensitive database subnet. According to standard NIST incident response frameworks, which of the following actions should the incident response team perform FIRST?

  1. A
    Purge all unauthorized rogue workload pods and update the container registry image to eliminate malicious code.
  2. Revoke the compromised service account token and isolate the affected cluster worker nodes from the network.Answer
  3. C
    Deploy an inline web application firewall rule to inspect incoming payload patterns for malicious container command signatures.
  4. D
    Re-image the cluster control plane nodes and restore state store configurations from the most recent backup.

Answer

Revoke the compromised service account token and isolate the affected cluster worker nodes from the network.
The correct response prioritizes immediate containment in accordance with standard incident response playbooks (such as NIST SP 800-61). Revoking the compromised service account credentials invalidates the attacker's active API access, while isolating affected worker nodes prevents lateral movement toward adjacent subnets. Containment must always precede eradication and recovery.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
The incident has passed initial detection/analysis and requires immediate containment to stop ongoing lateral movement.
NIST SP 800-61 dictates that containment must occur immediately after detection to limit damage and prevent vector expansion.
2
Evaluate candidate response actions against the NIST Incident Response lifecycle order.
Revoking active compromised tokens and network-isolating affected worker nodes stops threat propagation during the containment phase.
Eradication (deleting malicious pods) and Recovery (re-imaging nodes) must follow containment, while perimeter controls (WAF rules) fail to stop internal lateral movement.
3
Select the immediate next step.
Executing token revocation and node isolation guarantees containment before further remediation takes place.
Containing the blast radius is the essential prerequisite for forensic preservation and subsequent eradication.

Key Concept

Incident Response Process and Playbooks
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic