Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During an ongoing incident investigation, a Security Operations Center (SOC) team detects that an automated Continuous Integration/Continuous Deployment (CI/CD) build server has been compromised. An attacker modified build scripts to exfiltrate enterprise API credentials to an external host while continuing to compile production software images. Which TWO of the following containment actions should the incident response team perform immediately to mitigate the incident while preserving evidence?

  1. Isolate the compromised build server network interface via virtual firewall rules while capturing its volatile RAM.Answer
  2. Revoke and rotate the exposed API tokens and service account credentials associated with the build pipeline.Answer
  3. C
    Purge the source repository commit logs and immediately re-image the build server operating system from clean media.
  4. D
    Apply a network filter blocking all inbound HTTP/HTTPS traffic to the primary enterprise core perimeter router.

Answer

The containment strategy requires isolating the compromised build server network interface while capturing volatile memory, alongside revoking and rotating all exposed API tokens and service account credentials.
Effective containment of a compromised automation pipeline requires stopping both host communication and credential abuse. Isolating the build server at the network level combined with memory capture preserves volatile forensic evidence while halting exfiltration. Concurrently, revoking and rotating exposed API tokens prevents the adversary from leveraging stolen credentials against peripheral enterprise resources.

Step-by-Step Solution

1
Identify immediate containment goals
Determine that stopping active exfiltration and preventing unauthorized API access takes priority during containment.
Containment limits the scope and damage of an incident without prematurely destroying forensic artifacts.
2
Preserve state while stopping network exfiltration
Isolate the virtual host at the network layer and acquire a memory dump.
Acquiring memory prior to shut down ensures critical volatile evidence (such as injected process memory) is preserved.
3
Invalidate exfiltrated identity assets
Revoke and re-issue all affected tokens and secrets.
Exfiltrated credentials allow threat actors to bypass perimeter boundaries regardless of host containment.

Key Concept

Incident Response Containment Strategies and Evidence Preservation
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic