GCIH · Question #485
A successful phishing attack led to multiple user workstations being infected with command and control malware. Which of the following would be an effective short-term containment activity?
The correct answer is B. Move hosts to a VLAN without Internet access. Short-term containment is meant to stop the bleeding. Command and control traffic originates from compromised hosts and can be send via HTTP/HTTPS, DNS, and other protocols. Isolating a host on a private VLAN would be an effective response to stop C2 connections. C2 traffic is…
Question
A successful phishing attack led to multiple user workstations being infected with command and control malware. Which of the following would be an effective short-term containment activity?
Options
- ASearch for hidden files and processes running on the hosts
- BMove hosts to a VLAN without Internet access
- CBlock incoming port 80 and 443 traffic to the hosts
- DDeploy a web proxy to detect tunneled traffic
How the community answered
(38 responses)- A18% (7)
- B74% (28)
- C5% (2)
- D3% (1)
Explanation
Short-term containment is meant to stop the bleeding. Command and control traffic originates from compromised hosts and can be send via HTTP/HTTPS, DNS, and other protocols. Isolating a host on a private VLAN would be an effective response to stop C2 connections. C2 traffic is outbound not inbound, and most clients aren't listening on ports 80/443. Root cause analysis and eradicating artifacts isn't a short-term containment activity. A web proxy could be a longer term remediation identified in the lessons learned report or as part of recovery, but it would not be a containment activity.
Topics
Community Discussion
No community discussion yet for this question.