Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

A security analyst in a SOC detects unauthorized PowerShell script execution originating from an HR department workstation that is actively communicating with an external command-and-control server. The analyst immediately isolates the workstation from the enterprise network using the EDR console. According to standard incident response frameworks, which of the following actions should the analyst perform NEXT?

  1. Preserve volatile memory and collect forensic evidence to analyze the persistence mechanism.Answer
  2. B
    Re-image the workstation's hard drive and restore user files from the most recent system backup.
  3. C
    Deploy automated network-wide removal scripts targeting self-propagating worm binaries.
  4. D
    Deploy Web Application Firewall rules to block cross-site scripting payloads across external portals.

Answer

Preserve volatile memory and collect forensic evidence to analyze the persistence mechanism.
Under standard incident response frameworks (such as NIST SP 800-61), once containment is achieved via network isolation, responders must capture volatile evidence (RAM, active connections, running processes) and conduct root-cause analysis before carrying out eradication or recovery activities.

Step-by-Step Solution

1
Identify the completed incident response phase from the scenario context.
Network isolation of the workstation has been completed, fulfilling the containment objective.
Determining the current status within the IR lifecycle (Preparation -> Detection & Analysis -> Containment -> Eradication -> Recovery -> Lessons Learned) establishes proper operational sequencing.
2
Determine the mandatory actions required before modifying host state.
Preserve RAM and volatile forensic evidence while the host is contained but powered on.
Capturing volatile memory and system artifacts is vital for identifying root cause, privilege escalation pathways, and scope of compromise prior to system wipe.
3
Select the response that conducts analysis and evidence preservation following containment.
Collecting volatile memory and forensic evidence is the appropriate next step.
It aligns strictly with NIST SP 800-61 guidelines for investigation before moving to eradication.

Key Concept

Incident Response Lifecycle Phase Progression and Evidence Preservation
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic