A security analyst monitoring session logs observes multiple concurrent active sessions originating from different geographic regions for a single administrative account on an enterprise cloud portal, indicating active session hijacking. According to standard incident response playbooks, which of the following actions should the team perform immediately as part of the containment phase? (Select TWO.)
- Revoke all active session tokens and force a credential reset for the compromised account across the identity provider.Cevap
- Apply network egress filters to block communication between internal systems and the adversary's IP address.Cevap
- CRebuild and redeploy the cloud portal instance from a verified baseline backup image to ensure no backdoor exists.
- DSchedule an executive debrief meeting to document gaps in session timeout configurations and update the security baseline policy.
Cevap
The containment phase requires immediately invalidating compromised active session tokens via the identity provider and enforcing perimeter IP blocking against the adversary's infrastructure.
Invalidating hijacked session tokens and placing block rules against adversary IP addresses directly stop active unauthorized access, fulfilling the primary goal of the containment phase.
Adım Adım Çözüm
Anahtar Kavram
Incident Response Containment Phase Actions
Tahmini Süre:1m 30s