hardMultiple ChoiceObjective-mapped
CISSP Practice Question: During an incident response, the team identifies…
During an incident response, the team identifies that the attacker gained access through a compromised service account with domain admin privileges. Which of the following steps should be taken FIRST to contain the incident?
⚠ Common exam trap
ISC2 often tests the principle that containment must be immediate and targeted; candidates mistakenly choose isolation or forensic analysis first, forgetting that the compromised account is the root cause and that tokens can outlive password resets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the compromised account and revoke its tokens.
Disabling the compromised account and revoking its tokens (e.g., Kerberos TGTs via `Set-ADAccountControl -Disable` and clearing cached tickets) immediately stops the attacker's current authentication and lateral movement capabilities. This is the fastest containment step because the service account with Domain Admin privileges is the direct vector; isolating systems or resetting all passwords is slower and may not address active token reuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Isolate all affected systems from the network.
Why it's wrong here
While network isolation is a valid containment strategy, isolating all affected systems can be overly broad, disruptive, and time-consuming, especially if the compromise is limited to a specific account. This action might also inadvertently alert the attacker to defensive measures, potentially prompting them to escalate or pivot to other attack vectors rather than immediately stopping their current activity.
- ✗
Reset all user passwords.
Why it's wrong here
Resetting all user passwords is a highly disruptive and untargeted action that can cause significant operational impact across the entire organization without directly addressing the immediate threat. The incident specifically identifies a compromised account, meaning the attacker's current access is tied to that particular credential, making a blanket password reset an inefficient and potentially counterproductive response.
- ✗
Perform a full forensic analysis before any action.
Why it's wrong here
Initiating a full forensic analysis before taking any containment action is a critical error in incident response, as the primary objective during the containment phase is to stop the spread of the incident and minimize further damage. Delaying containment to perform extensive analysis allows the attacker more time to escalate privileges, exfiltrate data, or establish persistence, thereby increasing the overall impact and complexity of the incident.
- ✓
Disable the compromised account and revoke its tokens.
Why this is correct
Disabling the compromised account and revoking its associated tokens directly and immediately severs the attacker's primary access vector and any active sessions within the environment. This precise action effectively contains the immediate threat by removing the attacker's foothold, preventing further unauthorized actions or data exfiltration, and minimizing disruption to other legitimate users.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.