200-201 Question 339
Select 3During a cybersecurity incident, an organization's email server has been compromised and is being used to send phishing emails to external recipients. As a member of the incident response team, what steps should you take to effectively contain, eradicate, and recover from this incident?
- A
Block outgoing email traffic from the compromised server at the firewall.
- B
Rebuild the email server from a known clean backup and patch all vulnerabilities.
- C
Notify all affected external recipients of the phishing emails and advise them to ignore or delete the messages.
- D
Monitor the compromised server for further malicious activity before taking any action to preserve evidence.
- E
Reset all user passwords and apply multi-factor authentication (MFA) organization-wide.
Show answer and explanation
Correct answers: A, B, C
Explanation
Effective incident response involves containment, eradication, and recovery. Blocking outgoing email traffic prevents further damage (containment), rebuilding the server eradicates the root cause, and notifying affected recipients helps mitigate the impact of the incident. Monitoring without action delays resolution, and while password resets and MFA are good security practices, they are not directly relevant to this specific scenario.
- A. Correct.
Blocking outgoing email traffic from the compromised server is a critical containment step to prevent further phishing emails from being sent.
- B. Correct.
Rebuilding the email server from a clean backup ensures the eradication of the malicious software or configuration changes used in the compromise. Patching vulnerabilities prevents the attacker from re-exploiting the system.
- C. Correct.
Notifying affected external recipients is part of the recovery phase to mitigate the impact of the phishing emails and restore trust with external parties.
- D. Incorrect.
Monitoring the server without taking action delays containment and allows the malicious activity to continue, worsening the impact of the incident.
- E. Incorrect.
Resetting all user passwords and applying MFA is a general security practice but is not directly related to containing or eradicating the specific email server compromise in this scenario.