Examkin

Soru

Zorluk: KolayIncident Response Process and Playbooks

A security analyst discovers that a developer's API key was publicly exposed in a code repository and is actively being used by an unauthorized external entity to read data from a cloud storage bucket. According to standard incident response playbooks, which of the following immediate CONTAINMENT steps should the analyst take? (Select TWO.)

  1. Revoke or disable the compromised API key immediately to terminate unauthorized access.Cevap
  2. Apply an explicit firewall or security group rule to block traffic from the attacker's external IP address.Cevap
  3. C
    Conduct a post-incident lessons learned meeting to discuss repository secret-scanning procedures.
  4. D
    Completely rebuild and re-image the enterprise identity provider server infrastructure.

Cevap

The analyst should immediately revoke the compromised API key and block the attacker's external IP address.
During the containment phase of the incident response lifecycle, the primary goal is to prevent further exposure and stop active malicious activity. Revoking the exposed API key immediately invalidates the attacker's authentication material, while blocking the malicious IP address prevents further inbound traffic from that vector.

Adım Adım Çözüm

1
Identify the immediate containment objective
Determine that active data access via the stolen credential must be stopped without delay.
Containment limits the scope and impact of an active incident before proceeding to eradication.
2
Select appropriate containment controls
Disabling the compromised API key invalidates the authentication token, and blocking the source IP mitigates incoming request traffic.
These actions stop the attack vector immediately while preserving system availability for non-compromised services.

Anahtar Kavram

Incident Response Containment Phase
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru