CompTIA Security+ (SY0-701)Security OperationsHard
During an active incident, the IR team discovers malware spreading laterally via SMB across multiple internal subnets. The team wants to stop further propagation immediately while still preserving the ability to monitor and analyze the malware's live behavior. Which containment strategy is most appropriate?
- AApply network segmentation to isolate the affected subnet via VLAN/ACL changes while keeping systems powered on
- BImmediately power off all affected systems to halt malware execution
- CReimage all affected endpoints immediately to remove the malware
- DDisconnect the entire enterprise network from the internet
Show answer & explanationAnswer & explanation
Correct answer: A. Apply network segmentation to isolate the affected subnet via VLAN/ACL changes while keeping systems powered on
Segmenting the affected subnet using VLAN or ACL controls stops lateral spread while keeping systems running and network-visible, allowing analysts to continue observing the malware's live behavior. Powering off or reimaging would destroy volatile evidence and the ability to observe live activity, and a full internet disconnect is overly broad and disrupts unaffected business operations.
Why the other options are wrong
- B. Powering off systems halts propagation but destroys volatile memory evidence and observation ability.
- C. Reimaging immediately destroys evidence and forensic value before analysis and root-cause determination are complete.
- D. A full internet disconnect is disproportionate and disrupts unaffected systems/business operations unnecessarily.
Incident Containment Strategies
Techniques used during incident response to stop threat propagation while balancing the need to preserve evidence and business continuity.
- Segmentation isolates traffic without shutting systems down
- Isolation/quarantine removes single hosts from the network
- Full shutdown destroys volatile evidence
- Strategy choice depends on scope, evidence needs, and business impact
Memory trick: Segment the sick ward, don't shut off the hospital