Examkin

Soru

Zorluk: KolayIncident Response Process and Playbooks

A security analyst confirms that an internal user workstation is infected with active malware that is attempting to communicate with an external command-and-control server. According to standard incident response lifecycle frameworks (such as NIST SP 800-61), which of the following actions should the analyst take immediately after confirming the incident?

  1. Isolate the compromised workstation from the local network segment.Cevap
  2. B
    Re-image the workstation hard drive to remove all malicious files.
  3. C
    Restore missing user data files from the most recent secure backup.
  4. D
    Schedule a lessons-learned meeting with key business stakeholders.

Cevap

Isolate the compromised workstation from the local network segment.
Isolating the affected system from the network is the essential initial containment step. It prevents lateral movement and external command-and-control communication while preserving system state for analysis.

Adım Adım Çözüm

1
Identify the current phase of the Incident Response lifecycle.
The incident has just been confirmed during the Detection and Analysis phase.
Determining the current phase dictates the appropriate immediate objective.
2
Determine the next sequential phase in standard frameworks (such as NIST SP 800-61).
The immediate next phase is Containment, Eradication, and Recovery, beginning with Containment.
Containment limits the scope of damage and prevents the malware from spreading or exfiltrating data.
3
Select the action corresponding to containment.
Network isolation of the host isolates the threat while allowing further analysis.
Isolating the workstation stops network transmission without destroying volatile forensic evidence on the host.

Anahtar Kavram

Incident Response Lifecycle Phase Order (NIST SP 800-61)
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru