Examkin

Soru

Zorluk: KolayIncident Response Process and Playbooks

A security analyst detects active data exfiltration originating from a compromised database server. Which of the following incident response steps should be taken first?

  1. Isolate the affected server from the network to stop the data transfer.Cevap
  2. B
    Reformat the hard drives and reinstall the operating system.
  3. C
    Restore the database contents from a known clean backup baseline.
  4. D
    Hold a lessons learned meeting to review security incident documentation.

Cevap

Isolate the affected server from the network to stop the data transfer.
Isolating the affected server immediately contains the active incident by terminating ongoing exfiltration channels and preventing lateral movement across the internal network.

Adım Adım Çözüm

1
Identify the current state of the security incident from the scenario.
An attack is actively occurring (data exfiltration in progress).
Active threats require immediate containment to limit damage and prevent further exfiltration.
2
Map the candidate actions to standard incident response lifecycle phases.
Isolating the host belongs to Containment, formatting belongs to Eradication, restoring belongs to Recovery, and reviewing belongs to Post-Incident Activity.
Standard NIST incident response guidelines dictate performing Containment prior to Eradication, Recovery, or Post-Incident activities.

Anahtar Kavram

Incident Response Lifecycle Order
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru