Examkin

Soru

Zorluk: OrtaIncident Response Process and Playbooks

A security handler confirms that a cloud administrator host is actively exporting database backups to an unapproved external storage endpoint using hijacked API credentials. Following standard incident response procedures, which of the following actions should the security handler take FIRST?

  1. Revoke the compromised API credentials and restrict the host's network connectivity.Cevap
  2. B
    Reimage the host operating system and restore database files from verified offline backups.
  3. C
    Deploy a web application firewall rule designed to block cross-site scripting attack payloads.
  4. D
    Initiate network-wide antivirus scanning to remove self-replicating network worm components.

Cevap

Revoke the compromised API credentials and restrict the host's network connectivity.
In standard incident response frameworks (such as NIST SP 800-61), once an active breach or exfiltration event is detected, containment is the immediate priority. Revoking compromised API keys and isolating the affected system prevents further data loss without altering offline forensic evidence.

Adım Adım Çözüm

1
Analyze the incident scenario and determine the current phase of incident response.
An active data exfiltration incident is occurring via hijacked administrative credentials.
Immediate containment is required to minimize exposure and halt ongoing unauthorized access.
2
Select the appropriate immediate containment action according to standard NIST IR playbooks.
Revoking session keys/credentials and isolating the administrator host halts exfiltration immediately.
Containment actions must precede eradication (reimaging) or recovery (restoring from backups).

Anahtar Kavram

Incident Response Lifecycle - Containment Phase
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru