Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During an operational shift, a security analyst receives a high-fidelity alert indicating that an internal database server containing confidential HR records has established an active session with an external command-and-control (C2) server via encrypted DNS over HTTPS (DoH) tunnels. Memory analysis confirms an active process executing malicious commands, but lateral movement to adjacent servers has not yet been observed. According to standard incident response lifecycle guidelines (such as NIST SP 800-61), which action should the analyst perform FIRST?

  1. Isolate the compromised database server from the network segment to halt C2 communications while preserving system volatility for forensic examination.Answer
  2. B
    Re-image the server operating system from a verified golden image and restore the HR database from an offline backup.
  3. C
    Modify enterprise edge firewall rules to act as a detective control by capturing and logging all outbound UDP port 53 traffic.
  4. D
    Terminate the malicious process and delete its registry persistence keys directly on the live server while keeping it fully online for business continuity.

Answer

Isolate the compromised database server from the network segment to halt C2 communications while preserving system volatility for forensic examination.
According to standard incident response frameworks (NIST SP 800-61), once an active compromise with command-and-control communication is confirmed during detection/analysis, the immediate next step is Containment. Network isolation of the compromised host stops data exfiltration and lateral movement while preserving volatile memory for digital forensics.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle.
The incident has been detected and triaged; the active C2 session indicates an ongoing security breach.
Once an active breach is confirmed, containment must immediately take precedence to prevent data exfiltration and lateral movement.
2
Select the action that aligns with the Containment phase of NIST SP 800-61.
Network isolation detaches the system from internal and external networks while maintaining volatile RAM state.
Containment limits the blast radius of the attack prior to initiating eradication or recovery procedures.
3
Evaluate alternative responses to verify correct phase sequencing.
Re-imaging, live process removal, and network-wide logging adjustments represent out-of-order phase actions or ineffective control applications.
Eradication and recovery steps performed prematurely undermine incident containment and evidence preservation.

Key Concept

Incident Response Lifecycle Containment Phase
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic