Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst receives a validated alert indicating unauthorized administrative credential usage and potential persistence mechanisms on a critical internal server. According to standard incident response frameworks and playbooks, the analyst must focus on immediate containment and evidence preservation. Which of the following actions should the analyst perform at this stage? (Select TWO.)

  1. Place the affected server into an isolated quarantine VLAN to prevent lateral movement while preserving volatile state.Answer
  2. B
    Wipe the hard drive immediately and reinstall the operating system using a golden image.
  3. Capture a full image of volatile memory (RAM) to preserve active network connections and running process artifacts.Answer
  4. D
    Conduct a formal post-incident lessons learned session to update the enterprise incident response playbook.

Answer

The analyst should isolate the server on a quarantine VLAN and capture a full image of volatile memory (RAM).
Isolating the compromised host on a quarantine VLAN halts lateral network movement while keeping the system powered, allowing analysts to capture volatile memory (RAM) to preserve ephemeral evidence such as running processes and active sockets before it is lost.

Step-by-Step Solution

1
Identify the active incident response phase requested in the scenario.
The scenario requires executing immediate containment and evidence preservation procedures.
Standard NIST and ISO incident response lifecycles mandate containing threats and securing volatile evidence before eradication or recovery.
2
Evaluate the choices to find actions that fulfill containment and preservation requirements.
Quarantining the network connection contains the attack, while RAM acquisition preserves volatile memory artifacts.
Placing the machine in a quarantine VLAN halts lateral movement without shutting down the host, allowing RAM to be captured following the order of volatility.
3
Eliminate options corresponding to out-of-order lifecycle phases.
Reimaging (eradication) and post-incident lessons learned (post-incident activity) are misaligned with initial containment.
Executing eradication or post-incident review steps out of sequence compromises forensic evidence and operational integrity.

Key Concept

Incident Response Containment and Evidence Preservation Lifecycle Phases
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic