CCNA Incident Handling and Response Questions

Identification is the phase where an event is confirmed as an incident and its scope is assessed. The antivirus alert and quarantine confirmation constitute detection and initial validation of a real security event. The analyst has not yet contained, eradicated, or recovered anything, so Identification is the correct phase according to the SANS PICERL model.

The Post-Incident Activity phase centers on reviewing the incident to improve future response. A structured meeting with stakeholders captures lessons, identifies gaps in the plan, and assigns improvements. This directly fulfills the phase's purpose of turning experience into actionable changes, making it a correct activity for this scenario.

Network isolation via NAC or EDR containment severs the adversary's access while keeping the host running, so volatile memory and active connections remain available for capture. This limits spread to other production servers and preserves evidence, satisfying both containment and forensic requirements. It is the most balanced strategy for a live compromised host on a shared VLAN.

The Incident Response Plan is the primary document that outlines the steps to take during a breach, including legal and regulatory notification requirements. Having this plan in place ensures that legal obligations are met promptly, reducing the risk of non-compliance penalties and ensuring consistent communication with regulatory authorities.

Containment aims to limit the scope and impact of an incident. Isolating the server prevents further lateral movement and stops the attacker from exfiltrating data or causing more damage. This is a classic containment action, as it separates the affected system from the rest of the network while allowing forensic analysis to continue.

Disabling macros by default and allowing only signed macros from trusted publishers directly prevents the execution of malicious macros, which was the initial infection vector. This is a technical control that enforces a secure configuration and is highly effective because it blocks the attack technique regardless of user action. It aligns with the principle of least functionality and is a recommended security baseline.

The log displays an XSS payload injected into a form field, which the framework correctly blocked. This activity represents an active probe by an attacker. It must move to the Identification phase to determine the extent of the scanning or exploitation attempts being conducted against the web application.

The analyst is capturing volatile data such as network connections, processes, and kernel modules while the system is live, before it changes or is lost. This directly follows the order of volatility principle, which prioritizes the most perishable evidence first. Running the script before copying binaries reflects that prioritization, making this the correct principle.

If an attacker has stolen credentials, simply removing the backdoor is insufficient because the attacker can still authenticate using the compromised account. Resetting passwords is a mandatory eradication step to prevent the adversary from regaining access via legitimate authentication channels after the malicious artifacts are removed.

The analyst deleted files before containing the workstation, leaving it networked and allowing the malware to spread or communicate. Proper sequence is containment then eradication. Deleting files with elevated credentials also risks tipping off the attacker and destroying volatile evidence. This is the most direct violation of the containment-first principle.

Physical memory is the most volatile evidence and contains running processes, network connections, and injected code that vanish on shutdown. Capturing it first with a trusted, forensically sound tool satisfies the order of volatility while allowing containment afterward. This balances evidentiary integrity with the operational need to limit downtime, making it the best action in this scenario.

The lessons-learned meeting is part of the post-incident activity phase, but the specific finding about log integration directly addresses preparation. Improving log sources and SIEM integration enhances future readiness and detection capabilities. Preparation encompasses building and maintaining the tools and processes needed to respond effectively, so this finding aims to strengthen that phase.

Isolating the host prevents the attacker from issuing further commands or exfiltrating data, effectively containing the threat. By cutting the network path, you stop the malicious script from reaching its destination without destroying the volatile memory evidence needed to identify the full scope of the attack activity.

Applying security patches and updates is part of eradication because it addresses the vulnerability that may have been exploited. Even if the malware is removed, without patching, the server remains vulnerable to re-infection. Eradication involves not only removing the threat but also eliminating the root cause. Patching is a preventive measure that strengthens the system against future attacks.

Automated response tools rely on playbooks to determine actions. If these are not pre-defined and tested, the tool could inadvertently disrupt business operations. Validated playbooks ensure the automation performs safe and effective containment actions without requiring manual intervention, which is essential during a fast-moving, high-severity security incident.