Examkin

Soru

Zorluk: OrtaIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst receives a high-priority alert indicating that an enterprise Voice over IP (VoIP) management server has established unauthorized outbound secure shell (SSH) sessions to an unknown external IP address and is attempting horizontal scanning across internal server subnets. The analyst inspects network logs and confirms that an active remote code execution exploit took place through the server's web administration panel. According to standard incident response playbooks, which of the following actions should the analyst perform FIRST?

  1. Isolate the compromised VoIP server from the network segment while preserving host volatile memory for forensic investigation.Cevap
  2. B
    Perform root-cause analysis by terminating active background processes and applying patches to the VoIP web management portal vulnerability.
  3. C
    Re-image the VoIP server operating system and restore system configuration files from the latest verified offline backup.
  4. D
    Modify enterprise perimeter firewalls to block all inbound HTTP and HTTPS traffic to all public-facing web servers.

Cevap

Isolate the compromised VoIP server from the network segment while preserving host volatile memory for forensic investigation.
In accordance with standard NIST SP 800-61 incident response frameworks, once an active system compromise is confirmed, the immediate priority is containment. Isolating the compromised VoIP server from the network halts unauthorized lateral movement and outbound command-and-control communications. Preserving volatile RAM ensures vital forensic evidence remains available for analysis.

Adım Adım Çözüm

1
Identify the current incident response phase based on the scenario state.
The compromise has just been verified, placing the response at the Containment phase.
Before any remediation or recovery can take place, active threats must be contained to prevent further damage or lateral movement.
2
Select the action that properly executes containment while preserving forensic evidence.
Network isolation stops external command-and-control traffic and internal scanning while keeping RAM intact.
Preserving volatile memory (RAM) is crucial before power-down or network disconnect, supporting chain of custody and forensic triage.

Anahtar Kavram

Incident Response Lifecycle - Containment Phase
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru