300-215 Question 202
Select 2A security operations team is alerted to a potential ransomware infection on an employee's workstation. The team initiates the organization's incident response plan and begins containment procedures. Which of the following actions should the team perform as part of the containment phase?
- A
Disconnect the affected system from the network to prevent further spread.
- B
Shut down the affected system immediately to stop the ransomware process.
- C
Capture a memory dump for forensic analysis before taking further action.
- D
Apply patches to all systems in the network to close potential vulnerabilities.
- E
Redirect the affected system's traffic to a sinkhole for monitoring.
Show answer and explanation
Correct answers: A, C
Explanation
The containment phase of incident response involves isolating the affected system to prevent further damage and collecting critical forensic evidence for analysis. Disconnecting the system and capturing a memory dump are appropriate actions to achieve these goals, while shutting down the system or redirecting traffic may hinder the investigation process or be irrelevant for ransomware cases.
- A. Correct.
Disconnecting the affected system from the network is a critical containment step to prevent the ransomware from spreading to other devices.
- B. Incorrect.
Shutting down the system immediately is not recommended as it may destroy volatile data, such as memory artifacts, that could be useful for forensic analysis.
- C. Correct.
Capturing a memory dump allows the team to preserve volatile data, such as processes and encryption keys, which may be important for investigation and response.
- D. Incorrect.
Applying patches is a proactive step but not directly part of the immediate containment phase, which focuses on isolating and limiting the impact of the incident.
- E. Incorrect.
Redirecting the affected system's traffic to a sinkhole is more appropriate for specific types of threats (e.g., botnets) but is not typically used for ransomware containment.