Examkin

Soru

Zorluk: OrtaIncident Response Process and Playbooks

During an ongoing incident, a security analyst discovers that an internal web application service account was compromised and is actively attempting unauthorized Kerberoasting attacks to extract Active Directory ticket-granting service hashes. According to standard NIST incident response frameworks, which of the following actions should the incident response team perform FIRST during the containment phase?

  1. Disable the compromised service account and isolate the host hosting the web application from the internal network.Cevap
  2. B
    Re-image the Active Directory Domain Controller operating system to ensure all malicious session tickets are completely destroyed.
  3. C
    Deploy an inline intrusion detection system (IDS) sensor on the domain subnet to monitor for secondary credential harvesting attempts.
  4. D
    Purge all SQL injection logs from the web server to prevent worm self-replication across connected subnets.

Cevap

Disable the compromised service account and isolate the host hosting the web application from the internal network.
The correct response prioritizes immediate containment by disabling the compromised credentials and isolating the compromised host from the network. In the NIST incident response lifecycle, containment must occur before eradication or recovery to prevent the adversary from expanding their breach footprint across the domain.

Adım Adım Çözüm

1
Identify the phase of the incident response lifecycle required by the scenario.
The scenario requires an immediate action in the Containment phase of the NIST incident response framework.
Containment focuses on limiting the scope and impact of an active breach to prevent lateral movement and further unauthorized access.
2
Evaluate potential containment mechanisms for credential abuse and host compromise.
Disabling the affected service account revokes access, and isolating the host isolates the attack source.
Combining account disablement and host network isolation stops both credential-based lateral movement and host-based communications.
3
Distinguish containment actions from eradication, recovery, or detective controls.
Re-imaging belongs to eradication/recovery, passive monitoring is detective, and log purging destroys forensic evidence.
Proper IR playbooks require stopping the breach (containment) before conducting full cleanup (eradication) or restoration (recovery).

Anahtar Kavram

Incident Response Containment Phase Execution
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru