SSCP Systems Security Certified PractitionerIncident Response and RecoveryHard
A security team receives an alert indicating unauthorized access to a critical database server. During the initial investigation, they observe unusual queries and data exfiltration attempts. To prevent further data loss while preserving evidence for forensic analysis, which of the following containment strategies is generally considered the MOST appropriate immediate action?
- ADisconnect the database server from the network.
- BBlock the specific malicious IP address at the perimeter firewall.
- CReimage the database server with a known good backup.
- DImmediately shut down the database server.
Show answer & explanationAnswer & explanation
Correct answer: A. Disconnect the database server from the network.
Disconnecting the database server from the network (network isolation) stops further data exfiltration and attacker access while preserving the system's state for forensic analysis. Shutting down or reimaging would destroy volatile evidence.
Why the other options are wrong
- B. Blocking an IP might be insufficient if the attacker uses multiple IPs or moves laterally within the network.
- C. Reimaging destroys all evidence on the drive, which is counterproductive for forensics.
- D. Shutting down the server destroys volatile memory and can hinder forensic analysis.
Network Isolation (Containment)
A containment strategy that involves segmenting or disconnecting an affected system or network segment from the rest of the network to prevent further spread of an incident.
- Prevents further compromise and data exfiltration.
- Preserves the state of the affected system for forensics.
- Can be implemented quickly and effectively.
Memory trick: Containment: 'Isolate' to 'Investigate'.