Examkin

Soru

Zorluk: Çok zorIncident Response Process and Playbooks

A Incident Response Team is responding to an ongoing breach where an adversary compromised an automated CI/CD pipeline build runner service account. The attacker injected malicious code into build scripts and is actively exfiltrating deployment credentials over an encrypted tunnel. Playbook analysis indicates the attack payload includes an automated anti-forensic wiper script that triggers upon service account termination or system reboot. Which TWO of the following immediate actions should the incident response handler perform to isolate the threat and preserve volatile evidence? (Select TWO.)

  1. Apply a hypervisor-level network isolation filter to block network traffic from the build runner host while keeping the virtual machine powered on.Cevap
  2. Perform a volatile memory (RAM) capture of the compromised build runner system prior to terminating active sessions or credentials.Cevap
  3. C
    Immediately reboot the host into single-user recovery mode to kill active adversary process trees and run an offline antivirus scan.
  4. D
    Initiate an immediate host reimage using the gold deployment image to ensure complete eradication of the malicious build scripts.

Cevap

The incident response handlers should isolate the host at the hypervisor network boundary to cut off adversary connectivity without disturbing the operating environment, and take a full volatile RAM capture to preserve running processes and decryption keys before taking destructive actions.
Correct containment and evidence preservation strategy requires isolating the system from the network without altering volatile system state or powering off the machine. Hypervisor-level network isolation prevents command-and-control communication and data exfiltration while keeping the host active. Capturing volatile memory (RAM) prior to taking destructive actions ensures evidence integrity according to the RFC 3227 order of volatility.

Adım Adım Çözüm

1
Assess incident risks and order of volatility preservation constraints.
Identified that rebooting or revoking credentials immediately will trigger anti-forensic wiping scripts and destroy RAM contents.
NIST SP 800-61 Rev. 2 guidelines mandate preserving volatile evidence and preventing active exfiltration before initiating intrusive eradication tasks.
2
Execute non-disruptive network containment.
Network communication between the CI/CD runner host and external networks is restricted at the hypervisor layer.
Hypervisor network isolation halts C2 and data exfiltration while avoiding OS-level signal triggers that could detonate destructive payloads.
3
Capture volatile RAM.
System memory image acquired and cryptographically hashed for forensic integrity.
Preserves memory-resident payloads, active network sockets, and temporary credentials prior to credential revocation or host destruction.

Anahtar Kavram

Incident Containment Strategy and Order of Volatility Preservation
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru