Which activity would be conducted as part of the containment phase?

The correct answer is C. Move compromised systems to their own network segment based on approval from system. During containment, you may want to consider isolating the switch port to which the impacted machine is connected, or even place that system on an isolated, infected VLAN so that you can still communicate with it, but it cannot infect other machines. Containment (both short…

Incident Response & Cyber Kill Chain

Question

Options

ACompare recent backups with a current backup to remove malware an attacker could use to
BVerify the most recent system back up in case the system needs to be rebuilt later.
CMove compromised systems to their own network segment based on approval from system
DRun tools used to gather information about an external attacker from an uncompromised system

How the community answered

(55 responses)

A
4% (2)
B
2% (1)
C
95% (52)

Explanation

During containment, you may want to consider isolating the switch port to which the impacted machine is connected, or even place that system on an isolated, infected VLAN so that you can still communicate with it, but it cannot infect other machines. Containment (both short- and long- term) might stop the system from performing various business actions. Therefore, make sure you get approval before taking action that will impact business.

Topics

#containment phase#network segmentation#incident response lifecycle#compromised host isolation

Community Discussion

No community discussion yet for this question.

Full GCIH Practice