GSEC Incident Handling and Response Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reboot the workstation immediately

  Why it's wrong here

  Rebooting will clear volatile memory, destroying critical evidence such as the decrypted command string or active socket connections. Forensic best practices dictate that the system state must be preserved for analysis before any destructive actions like reboots are performed, as memory artifacts are essential for identifying the payload.

• ✓

  Isolate the workstation from the network

  Why this is correct

  Isolating the host prevents the attacker from issuing further commands or exfiltrating data, effectively containing the threat. By cutting the network path, you stop the malicious script from reaching its destination without destroying the volatile memory evidence needed to identify the full scope of the attack activity.

• ✗

  Delete the PowerShell process

  Why it's wrong here

  Terminating a process is an insufficient containment measure because the attacker may have already established other persistence mechanisms or secondary backdoors. The malicious process could also be a child of another service, leading to immediate respawning. Full network isolation is required to ensure the host is contained.

• ✗

  Update the antivirus definitions

  Why it's wrong here

  Updating antivirus is a long-term remediation step, not an immediate containment action. During an active incident involving encoded command execution, the priority is to stop the adversary's access. Relying on antivirus signatures is reactive and unlikely to stop a custom script that is already running in memory.