Examkin

Soru

Zorluk: OrtaIncident Response Process and Playbooks

A Security Operations Center (SOC) analyst receives a high-fidelity alert indicating that an internal workstation in the payroll department is establishing outbound DNS tunneling sessions to an unknown external IP address. Investigating the endpoint reveals active memory-resident scripts attempting to stage sensitive file archives. According to standard incident response frameworks, which of the following actions should the analyst take first?

  1. Disconnect the affected workstation from the network segment to isolate it.Cevap
  2. B
    Run an anti-malware scan to remove the malicious memory-resident scripts.
  3. C
    Restore the system operating system from a verified golden image backup.
  4. D
    Modify perimeter firewall ACLs to block all inbound TCP port 80 and 443 traffic.

Cevap

Disconnect the affected workstation from the network segment to isolate it.
The correct immediate action upon discovering an active threat communicating with an external malicious actor is containment. Disconnecting or network-isolating the affected workstation prevents ongoing data exfiltration and lateral spread without destroying volatile evidence stored in RAM.

Adım Adım Çözüm

1
Identify the current phase of the incident response lifecycle.
The incident is actively occurring with live command-and-control DNS tunneling, placing it squarely in the Containment phase.
Before performing analysis, cleanup, or restoration, active threat activity and data exfiltration must be stopped immediately.
2
Select the appropriate containment tactic.
Network isolation of the workstation prevents outbound communication and halts exfiltration while keeping volatile memory intact for forensics.
Containment limits the scope of damage without prematurely altering system state required for investigation.

Anahtar Kavram

Incident Response Lifecycle - Containment Phase
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru