During an ongoing incident investigation, an incident response team discovers that an employee's workstation was compromised via a malicious macro attachment, enabling unauthorized network scanning and lateral movement attempts towards internal file servers. According to standard incident response playbooks for host compromise, which of the following containment actions should the team perform immediately? (Select TWO.)
- Isolate the compromised workstation from the internal network by applying a quarantine network policy or disabling its switch port.Answer
- Revoke active authentication tokens and reset credentials for the user account associated with the compromised host.Answer
- CRe-image the workstation operating system and restore data from backups prior to capturing volatile RAM evidence.
- DDeploy an inline Web Application Firewall (WAF) directly onto the workstation to filter lateral network scans.
Answer
The correct immediate containment steps are isolating the compromised workstation from the internal network and revoking active authentication tokens and resetting credentials for the affected user account.
During the containment phase of incident response, playbooks prioritize preventing further spread of the threat and revoking compromised access. Isolating the infected host from the network stops active lateral movement, and invalidating active session tokens alongside credential resets prevents unauthorized account usage across the environment.
Step-by-Step Solution
Key Concept
Host and Identity Containment Actions in Incident Response Playbooks