Cisco Certified Support Technician (CCST) CybersecurityIncident HandlingHard
A security analyst is investigating a compromised web server. They suspect a zero-day exploit was used, and the attacker has established persistence. The analyst needs to apply a temporary patch or configuration change to prevent further exploitation while a permanent solution is developed. This action is best described as part of which containment strategy?
- ASystem Reimage
- BSegmentation Containment
- CWorkaround Containment
- DIsolation Containment
Show answer & explanationAnswer & explanation
Correct answer: C. Workaround Containment
Workaround Containment involves implementing temporary fixes, such as configuration changes or patches, to immediately stop the exploitation or spread of an incident without fully eradicating or recovering the system, allowing time for a permanent solution.
Why the other options are wrong
- A. System Reimage is an eradication/recovery step, not a temporary containment strategy.
- B. Segmentation Containment separates the compromised system's network segment.
- D. Isolation Containment completely disconnects the system from the network.
Workaround Containment
A containment strategy that involves implementing temporary fixes, configuration changes, or patches to stop the immediate threat or prevent further exploitation, allowing operations to continue with reduced risk.
- Focuses on immediate, temporary mitigation.
- Does not fully eradicate or recover the system.
- Buys time for a permanent solution or full eradication.
Memory trick: Containment: Isolate, Segment, Workaround, Restore.