A security analyst receives an escalation regarding an unidentified connection to the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a PowerShell process…

Question

Options

• AReview the server backup and identify server content and data critically to assess the intrusion risk.
• BIsolate the server and perform forensic analysis of the file to determine the type and vector of a possible attack.
• CIdentify the server owner through the CMDB and contact the owner to determine if these were planned and identifiable activities.
• DPerform behavioral analysis of the processes on an isolated workstation and perform cleaning procedures if the file is malicious.

• A
  21% (7)
• B
  61% (20)
• C
  12% (4)
• D
  6% (2)

Explanation

Option B is correct because the combination of an unidentified inbound connection, PowerShell and WMI processes (classic "living-off-the-land" attack techniques), and a dropped Portable Executable (PE) file in the system directory constitutes a strong indicator of compromise - the incident response playbook demands containment first, then investigation. Isolating the server stops lateral movement or data exfiltration while preserving the system state for forensic analysis.

A is wrong because reviewing backups is a recovery activity - it comes after containment and analysis, not before, and does nothing to stop an active threat.

C is wrong because while verifying planned activity with a system owner is reasonable for ambiguous alerts, the evidence here (unidentified connection + LOLBin processes + dropped executable) is specific enough to demand immediate containment; waiting on a CMDB lookup delays response and risks further damage.

D is wrong because moving the file to an isolated workstation for behavioral analysis skips the critical containment step - the server itself must be isolated first. Cleaning before full forensic analysis also risks destroying evidence needed to understand the full scope of the attack.

Memory tip: When you see the triad of suspicious connection + LOLBin (PowerShell/WMI) + dropped PE file, think "CI - Contain then Investigate." Any answer that skips isolation in favor of verification (C), recovery (A), or partial analysis (D) is wrong on an active compromise.

No community discussion yet for this question.