Examkin

Soru

Zorluk: OrtaIncident Response Process and Playbooks

During security monitoring, an analyst detects unauthorized data exfiltration via DNS tunneling originating from an internal web application server. The incident response team validates the threat and confirms the incident response playbook needs to be executed immediately. According to standard incident response lifecycle frameworks, which of the following actions should the responder take FIRST during the containment phase?

  1. Isolate the affected web server from the network while keeping it powered on.Cevap
  2. B
    Remove the malicious persistence scripts and restore system files from clean backups.
  3. C
    Reconfigure the edge firewall to block all inbound and outbound UDP port 53 traffic enterprise-wide.
  4. D
    Convene a post-incident review meeting with stakeholders to update the incident playbook.

Cevap

Isolate the affected web server from the network while keeping it powered on.
Isolating the affected host from the network immediately halts active data exfiltration via DNS tunneling while preserving volatile memory (RAM) needed for digital forensics. Following standard IR frameworks (such as NIST SP 800-61), containment must occur before eradication or recovery steps begin.

Adım Adım Çözüm

1
Identify the current Incident Response lifecycle phase based on the scenario.
The scenario transitions from Detection & Analysis into Containment.
Once an active threat like data exfiltration is verified, the IR team must act quickly to limit the scope of impact.
2
Determine the primary objective of the Containment phase.
Halt active data exfiltration while preserving volatile system memory for forensic preservation.
Disconnecting network interfaces or applying VLAN segregation isolates the threat without destroying RAM artifacts.
3
Select the action that aligns with immediate containment requirements.
Isolating the specific affected host from the network while keeping power maintained is the correct initial action.
Actions like remediation, playbook reviews, or broad network disruptions belong to different phases or cause unintended operational failure.

Anahtar Kavram

Incident Response Lifecycle Containment Strategy
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru