300-215 Question 112
Single answerDuring an ongoing incident, a security analyst is leveraging Cisco SecureX to coordinate the response effort. The analyst observes that multiple endpoints are showing signs of malware infection and decides to isolate these endpoints. What is the next step the analyst should take to ensure proper containment and minimize further damage?
- A
Quarantine the impacted endpoints using Cisco Secure Endpoint and notify the stakeholders.
- B
Immediately disconnect all endpoints in the network to prevent further spread.
- C
Perform a full forensic analysis on the endpoints before taking any action.
- D
Reboot the affected endpoints to remove any malicious processes.
Show answer and explanation
Correct answer: A
Explanation
In incident response, containment is a key phase aimed at limiting the scope of the incident and preventing further damage. Cisco Secure Endpoint provides the capability to quarantine infected systems without disrupting the rest of the network. This action ensures both effective containment and preservation of evidence for further forensic analysis.
- A. Correct.
Quarantining the impacted endpoints using Cisco Secure Endpoint ensures that the infection is contained while maintaining the integrity of the evidence. Notifying stakeholders is an essential step in the incident response process.
- B. Incorrect.
Disconnecting all endpoints in the network is a drastic measure and can disrupt business operations unnecessarily. It's important to isolate only the affected systems.
- C. Incorrect.
Performing a full forensic analysis before containment delays critical action, allowing the malware to potentially spread further.
- D. Incorrect.
Rebooting the affected endpoints can terminate malicious processes but may also delete critical evidence, making it harder to conduct a proper investigation.