An enterprise Security Operations Center (SOC) detects abnormal outbound DNS traffic indicating potential data exfiltration via DNS tunneling from an internal host. Place the incident response actions in the correct chronological order according to standard NIST incident handling guidelines, starting from the initial response through completion.
- 1Analyze DNS log queries and SIEM alerts to confirm the scope of tunneling traffic and identify the compromised internal source host.
- 2Implement egress firewall rules to block unauthorized outbound DNS queries and isolate the compromised workstation from the local network.
- 3Terminate the malicious background exfiltration process, remove persistent scripts from the workstation, and apply system updates.
- 4Conduct a post-incident review meeting with key stakeholders to update DNS monitoring playbooks and document lessons learned.
Cevap
The correct sequence follows the standard NIST incident response lifecycle: Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. First, analyze DNS logs and SIEM alerts to verify the threat and scope. Second, apply firewall rules and isolate the compromised workstation to contain exfiltration. Third, terminate malicious processes and remove malware during the eradication phase. Finally, conduct a post-incident review and update playbooks during the lessons learned phase.
The correct order follows the standard NIST SP 800-61 incident response lifecycle. The response begins with Detection and Analysis to confirm the incident and identify affected systems, followed by Containment to halt active DNS exfiltration and network movement. Eradication and Recovery follow to clear malicious artifacts and restore clean state, concluding with Post-Incident Activity to document lessons learned and enhance detection rules.
Adım Adım Çözüm
Anahtar Kavram
Incident Response Lifecycle Phases (NIST SP 800-61)