An enterprise Incident Response Team (IRT) detects unauthorized DNS redirection caused by ARP cache poisoning on a critical core network segment. According to standard NIST SP 800-61 incident response frameworks, in what order should the incident response team execute the following operational response steps?
- 1Capture network packet traces and volatile memory from the impacted hosts to preserve evidence.
- 2Apply static ARP entries on the gateway router and isolate the rogue host's switch port.
- 3Remove malicious ARP spoofing scripts from the compromised host and flush compromised ARP caches across the subnet.
- 4Re-enable dynamic resolution service on verified switches and monitor network traffic for residual anomalies.
- 5Conduct a post-mortem review with stakeholders to update network access control (NAC) policies and IR playbooks.
Cevap
The correct sequence follows the standard NIST incident response lifecycle: 1) Preserve evidence during Detection and Analysis, 2) Isolate the attack source during Containment, 3) Purge malicious tools and flush caches during Eradication, 4) Restore operations with monitoring during Recovery, and 5) Perform a lessons-learned review during Post-Incident Activity.
The standard incident response process requires systematically moving through Detection and Analysis (capturing volatile evidence), Containment (blocking rogue switch ports and applying static ARP mappings), Eradication (clearing poisoned ARP tables and deleting malicious scripts), Recovery (restoring standard network behavior under monitoring), and Post-Incident Activity (updating playbooks and holding a lessons-learned meeting).
Adım Adım Çözüm
Anahtar Kavram
NIST SP 800-61 Incident Response Lifecycle Phases