GCIH · Question #242
Adam works as an Incident Handler for Umbrella Inc. He has been sent to the California unit to train the members of the incident response team. As a demo project he asked members of the incident…
The correct answer is B. Containment. The listed actions - network isolation, VLAN segregation, firewall rules, and DNS redirection - are all techniques used to limit the spread of an incident without destroying evidence.
Question
Adam works as an Incident Handler for Umbrella Inc. He has been sent to the California unit to train the members of the incident response team. As a demo project he asked members of the incident response team to perform the following actions:
- Remove the network cable wires.
- Isolate the system on a separate VLAN
- Use a firewall or access lists to prevent communication into or out of the system.
- Change DNS entries to direct traffic away from compromised system
Which of the following steps of the incident handling process includes the above actions?
Options
- AIdentification
- BContainment
- CEradication
- DRecovery
How the community answered
(33 responses)- A3% (1)
- B94% (31)
- D3% (1)
Why each option
The listed actions - network isolation, VLAN segregation, firewall rules, and DNS redirection - are all techniques used to limit the spread of an incident without destroying evidence.
Identification is the phase where the team detects and confirms that an incident has occurred, not where isolation actions are taken.
Containment is the incident handling phase focused on limiting the damage and preventing further spread of the incident. The actions described - removing network cables, isolating to a VLAN, applying ACLs, and redirecting DNS - are classic containment strategies that restrict communication to and from a compromised system while preserving its state for analysis.
Eradication involves removing the root cause of the incident such as malware or compromised accounts, not isolating the system.
Recovery involves restoring systems to normal operation after the threat has been eliminated, which comes after containment and eradication.
Concept tested: Incident response containment phase actions
Source: https://www.nist.gov/publications/computer-security-incident-handling-guide
Topics
Community Discussion
No community discussion yet for this question.