Examkin

Soru

Zorluk: KolayIncident Response Process and Playbooks

A security analyst is executing an incident response playbook following a confirmed malware alert on a user workstation. Which of the following actions represent appropriate steps during the containment phase of the incident response process? (Select TWO.)

  1. Disconnecting the workstation from the network by disabling its network interfaceCevap
  2. Applying temporary ACLs at the perimeter firewall to block outbound communication to known malicious IP addressesCevap
  3. C
    Reimaging the infected system's hard drive using a standard gold master image
  4. D
    Holding a post-incident review session with the incident response team to update playbook documentation

Cevap

The appropriate containment steps are disconnecting the workstation from the network by disabling its network interface and applying temporary firewall ACLs to block outbound communication to malicious command-and-control servers.
During the containment phase of incident response, the main priority is stopping the spread of the attack and limiting its impact. Disabling the local network interface isolates the system from internal network assets, stopping lateral movement. Blocking outbound traffic to command-and-control IP addresses prevents ongoing data exfiltration and remote attacker control.

Adım Adım Çözüm

1
Determine the primary objective of the containment phase
Containment focuses on restricting the impact of an incident and preventing further damage or propagation.
Isolating infected systems and blocking active attack vectors stops the incident from spreading while preserving evidence for investigation.
2
Evaluate response actions against incident response phases
Disabling network connectivity and blocking command-and-control traffic directly restrict threat movement, fitting containment. Reimaging systems belongs to eradication/recovery, and reviewing playbooks belongs to post-incident activities.
Executing eradication or post-incident actions out of order can disrupt evidence collection or leave active threats uncontained.

Anahtar Kavram

Incident Response Containment Actions
Bu soruyu puanla

Konular

Incident Response Process and Playbooks

Bu konudan daha fazla soru