Examkin

Question

Difficulty: EasyIncident Response Process and Playbooks

An incident response team is executing a playbook following the detection of an active unauthorized remote access Trojan on an enterprise workstation. Which of the following actions represent appropriate steps to take specifically during the containment phase of the incident response lifecycle? (Select TWO.)

  1. Isolating the compromised workstation from the local network by disabling its network interfaceAnswer
  2. Blocking the remote command-and-control server's IP address at the perimeter firewallAnswer
  3. C
    Reimaging the affected workstation using an approved operating system baseline image
  4. D
    Holding a lessons-learned meeting with stakeholders to update the incident response playbook

Answer

The correct containment steps are isolating the compromised workstation from the local network by disabling its network interface, and blocking the remote command-and-control server's IP address at the perimeter firewall.
The containment phase aims to limit the blast radius of a confirmed security incident. Isolating the workstation from the network stops malware from spreading laterally across internal segments. Blocking command-and-control IP addresses at the firewall halts outbound control channels and data exfiltration while keeping evidence intact.

Step-by-Step Solution

1
Determine the core purpose of the containment phase in the incident response framework.
Containment focuses on restricting the spread of an active incident and mitigating damage while keeping systems stable and preserving evidence.
Stopping lateral movement and external C2 communications isolates the risk before permanent removal or rebuilding steps begin.
2
Map each option to its appropriate incident response lifecycle phase.
Host network isolation and perimeter firewall blocking limit breach scope (Containment). System reimaging purges the malware (Eradication). Post-incident reviews document lessons learned (Post-Incident Activity).
Distinguishing containment actions from eradication and post-incident activities ensures proper operational sequencing according to NIST SP 800-61 guidelines.

Key Concept

Incident Response Containment Strategies
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic