Examkin

Question

Difficulty: HardIncident Response Process and Playbooks

During off-hours monitoring, a Security Operations Center (SOC) analyst receives a high-severity alert indicating that an unauthorized IAM access key associated with a developer account is actively making API calls to export enterprise database snapshots to an unapproved external cloud storage location. The analyst verifies that data exfiltration is currently taking place in real time. Following standard NIST SP 800-61 incident response lifecycle guidelines, which of the following actions should the analyst take FIRST?

  1. A
    Perform a complete disk and volatile memory capture of the developer workstation to secure forensic evidence.
  2. Apply an explicit deny inline policy to the compromised IAM account to immediately revoke active API session tokens and halt exfiltration.Answer
  3. C
    Delete the unauthorized storage bucket copies and restore the affected database volumes from a known clean backup.
  4. D
    Configure Web Application Firewall (WAF) inspection rules to block incoming SQL injection patterns targeting the web front-end.

Answer

The analyst should immediately attach an explicit deny inline policy to the compromised IAM account to revoke active sessions and halt ongoing exfiltration.
The correct response is to apply an explicit deny policy to the compromised IAM user account. In the NIST SP 800-61 incident response framework, when an active data breach or exfiltration event is detected, the immediate priority is Containment. Disabling or restricting the compromised credentials stops the threat actor from making further API calls and halts exfiltration immediately.

Step-by-Step Solution

1
Identify the current incident response phase
The scenario describes an ongoing, active exfiltration breach in real time.
According to NIST SP 800-61, active breaches require immediate execution of Containment controls before moving to Eradication or detailed Forensics.
2
Evaluate containment actions for compromised cloud credentials
Applying an explicit deny policy or disabling the IAM access keys immediately revokes active API tokens and stops data exfiltration.
Containment limits the scope and damage of an active security incident.
3
Distinguish containment from out-of-order phases
Forensic evidence acquisition (Eradication/Analysis) and restoring data from backups (Recovery) are necessary subsequent steps, but must follow successful containment.
Executing recovery or forensic collection without prior containment allows malicious exfiltration to persist.

Key Concept

Incident Response Containment Phase Execution
Estimated Time:2m 0s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic