Examkin

Soru

Zorluk: OrtaIncident Response Process and Playbooks

During routine monitoring, a Security Operations Center (SOC) team detects an active Command and Control (C2) session originating from an internal workstation following the execution of an unauthorized payload. Security logs indicate the compromised host is attempting lateral reconnaissance against neighboring internal subnets. According to standard incident response frameworks, which of the following actions should the incident response team perform FIRST?

  1. Isolate the compromised workstation from the network using endpoint containment controlsCevap
  2. B
    Re-image the workstation operating system using a clean baseline image
  3. C
    Conduct a post-incident lessons learned review to update incident response playbooks
  4. D
    Reconfigure perimeter firewalls to convert existing logging rules into active blocking controls

Cevap

Isolate the compromised workstation from the network using endpoint containment controls
In standard incident response frameworks (such as NIST SP 800-61), once an incident is identified, the immediate priority is Containment. Isolating the compromised host from the network stops active Command and Control (C2) communication and prevents lateral movement to other internal systems before eradication and recovery steps take place.

Adım Adım Çözüm

1
Determine the current stage of the incident response lifecycle
The incident has been confirmed and active threat activity (C2 traffic and lateral movement) is identified.
Identifying the current phase determines the next mandatory action under NIST SP 800-61 frameworks.
2
Identify the immediate next lifecycle phase
The phase directly following Identification is Containment.
Containment limits the scope of damage and prevents further propagation of the compromise.
3
Select the appropriate containment procedure
Execute host-level isolation of the compromised endpoint.
Disconnecting the endpoint from the network isolates the threat without destroying volatile memory needed for evidence collection.

Anahtar Kavram

Incident Response Process and Playbooks - Containment Phase Execution
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru