Examkin

Question

Difficulty: Very hardIncident Response Process and Playbooks

During a multi-vector attack on a hybrid enterprise infrastructure, a security operations team identifies active data exfiltration using a compromised cloud service account API key, alongside automated ransomware scripts terminating database processes on internal servers. To effectively mitigate damage and recover services according to standard incident response frameworks, what is the correct chronological sequence of steps the response team must execute?

  1. 1Revoke compromised cloud service account API keys and block malicious origin IP addresses at the perimeter security boundary.
  2. 2Capture volatile memory dumps and preserve forensic disk images of affected internal database servers before initiating system modifications.
  3. 3Purge ransomware binaries, remove unauthorized persistence mechanisms, and delete rogue accounts created by the threat actor.
  4. 4Restore database systems from verified clean offline backups and conduct operational integrity testing before bringing services back online.
  5. 5Conduct a formal lessons-learned meeting to analyze the incident timeline, evaluate response efficacy, and update organizational playbooks.

Answer

The correct sequence starts with credential revocation and IP blocking (Containment), followed by volatile memory and disk forensic acquisition (Analysis/Preservation), followed by malware and persistence removal (Eradication), followed by clean backup restoration and integrity verification (Recovery), and concludes with a formal lessons-learned post-incident review (Post-Incident Activity).
According to NIST SP 800-61 and industry standard IR playbooks, containment (revoking compromised credentials and blocking origin IPs) must occur immediately to stop active exfiltration. Evidence acquisition (memory and disk forensic imaging) must follow prior to modifying systems. Eradication (purging malware binaries and persistence) ensures the adversary cannot maintain access. Recovery (restoring from clean offline backups and integrity validation) safely brings operations back online. Finally, post-incident activity (lessons learned and playbook updates) synthesizes the findings to improve future response.

Step-by-Step Solution

1
Execute immediate Containment controls by revoking compromised cloud API keys and applying perimeter IP blocks.
Stops ongoing data exfiltration and blocks active command-and-control communication.
Containment limits the scope of damage before additional actions are taken.
2
Perform Evidence Acquisition by capturing volatile memory and disk images from targeted database hosts.
Preserves forensic artifacts without altering volatile evidence needed for investigation.
Eradication or system re-imaging without prior forensic capture destroys volatile memory evidence.
3
Execute Eradication by removing ransomware artifacts, backdoor accounts, and scheduled tasks.
Completely eliminates the threat actor's presence and malware components from the environment.
Systems cannot be safely restored until all malicious presence has been removed.
4
Perform Recovery by restoring databases from known-good offline backups and validating system functionality.
Returns production services to normal operational state safely.
Restoration must occur after eradication to prevent re-infection upon bringing systems back online.
5
Conduct Post-Incident Activity including root-cause reporting and updating incident playbooks.
Improves security posture and response playbooks for future incidents.
Post-incident review requires complete incident resolution and documentation to evaluate overall performance.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Sequencing
Estimated Time:3m 0s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic