Examkin

Soru

Zorluk: KolayIncident Response Process and Playbooks

During routine network monitoring, a security operations center (SOC) analyst confirms the presence of an unauthorized rogue wireless access point connected directly to a wall port in the enterprise building. Following standard incident response procedures, which of the following actions should the analyst perform first?

  1. Disable the switch port associated with the rogue wireless access point.Cevap
  2. B
    Reimage all client workstations located within the immediate physical floor section.
  3. C
    Conduct a post-incident lessons learned session to revise physical security controls.
  4. D
    Configure an external perimeter firewall rule to block inbound remote management traffic.

Cevap

Disable the switch port associated with the rogue wireless access point.
Disabling the switch port isolates the rogue device from the network immediately, satisfying the requirement to contain the incident before executing recovery or post-incident activities.

Adım Adım Çözüm

1
Determine the current incident response stage
The security incident has been detected and verified, placing the immediate requirement in the containment phase.
Containment halts the expansion of an active threat and prevents further unauthorized access to internal resources.
2
Select the immediate containment control
Disabling the underlying network switch port disconnects the unauthorized rogue device from the internal network infrastructure.
Isolating the rogue access point stops network exposure immediately, enabling safe proceeding to eradication and recovery phases.

Anahtar Kavram

Incident Response Lifecycle Containment Phase
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru