212-82 · Question #164
You are the cybersecurity lead for an International financial institution. Your organization offers online banking services to millions of customers globally, and you have recently migrated your…
The correct answer is C. Isolate the affected cloud servers and redirect traffic to backup servers, ensuring continuous. To address an active SSRF vulnerability being exploited to access cloud metadata, the most immediate and effective action is to isolate the compromised servers and redirect traffic to maintain service continuity while containing the threat.
Question
You are the cybersecurity lead for an International financial institution. Your organization offers online banking services to millions of customers globally, and you have recently migrated your core banking system to a hybrid cloud environment to enhance scalability and cost efficiencies. One evening, after a routine system patch, there is a surge in server-side request forgery (SSRF) alerts from your web application firewall(WAF). Simultaneously, your intrusion detection system (IDS) flags possible attempts to interact with cloud metadata services from your application layer, which could expose sensitive cloud configuration details and API keys. This Is a clear Indication that attackers might be trying to leverage the SSRF vulnerability to breach your cloud infrastructure. Considering the critical nature of your services and the high stakes involved, how should you proceed to tackle this imminent threat while ensuring minimal disruption to your banking customers?
Options
- AEngage with a third-party cybersecurity firm specializing in cloud security to conduct an emergency
- BRollback the recent patch immediately and inform the cloud service provider about potential
- CIsolate the affected cloud servers and redirect traffic to backup servers, ensuring continuous
- DNotify all banking customers about the potential security incident, urging them to change their
How the community answered
(16 responses)- A13% (2)
- B6% (1)
- C69% (11)
- D13% (2)
Why each option
To address an active SSRF vulnerability being exploited to access cloud metadata, the most immediate and effective action is to isolate the compromised servers and redirect traffic to maintain service continuity while containing the threat.
Engaging a third-party firm is a valid long-term strategy for incident response and forensics, but it does not provide immediate containment or mitigation for an active SSRF exploit being used to access sensitive cloud metadata, which is the most pressing concern.
Rolling back the patch immediately might resolve the vulnerability if the patch introduced it, but it doesn't address the ongoing exploitation and potential data exfiltration already occurring, nor does it guarantee service continuity, and informing the cloud provider is secondary to immediate containment.
Isolating the affected cloud servers immediately contains the active SSRF exploitation by preventing further unauthorized access to cloud metadata services, while redirecting traffic to backup servers ensures critical banking services remain available to customers without interruption. This approach prioritizes both containment and business continuity, which are critical during an active security incident.
Notifying customers is an important step in the incident response lifecycle, especially for a financial institution, but it is not the immediate technical action required to stop an active server-side request forgery (SSRF) attack that is attempting to access cloud infrastructure details and API keys.
Concept tested: Incident response: containment and business continuity
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/incident-response
Topics
Community Discussion
No community discussion yet for this question.