During operational security monitoring, a SOC analyst receives an automated alert indicating that an administrative workstation has established unauthorized command-and-control (C2) communications following the execution of a malicious macro from a spear-phishing email. According to standard incident response playbooks for initial containment and evidence preservation, which of the following immediate steps should the analyst perform? (Select TWO.)
- Disconnect or isolate the affected workstation from the local network using host-level Endpoint Detection and Response (EDR) controls.Cevap
- Capture volatile system memory (RAM) and current network state artifacts prior to powering down or rebooting the endpoint.Cevap
- CImmediately wipe the local storage drive and re-image the host operating system to remove all malicious binaries.
- DDeploy a corrective firewall filter designed specifically to intercept Cross-Site Scripting (XSS) reflection payloads on internal domain controllers.
Cevap
The analyst should isolate the host network access using EDR controls and capture volatile memory (RAM) before taking hardware offline.
Isolating the endpoint via EDR controls effectively stops lateral movement and active C2 communication while preserving the live machine state. Collecting volatile memory (RAM) ensures sensitive volatile evidence is captured prior to system modification or shutdown.
Adım Adım Çözüm
Anahtar Kavram
Incident Response Containment Phase and Forensic Order of Volatility