350-201 Question 107
Select 3A security analyst is investigating a compromised host within the network. They suspect that malware has been installed and actively communicating with a command-and-control (C2) server. Which of the following actions would be the most effective in mitigating the potential threat from this host?
- A
Isolate the host from the network by applying a quarantine policy.
- B
Terminate the suspicious processes on the host and restart the affected services.
- C
Perform a snapshot or backup of the host for forensic analysis.
- D
Block outbound traffic from the host at the firewall to prevent C2 communication.
- E
Permanently delete all files related to the malware without further investigation.
Show answer and explanation
Correct answers: A, C, D
Explanation
Mitigating threats on a compromised host involves containment, preservation of evidence, and preventing further communication with malicious actors. Isolating the host, blocking outbound traffic, and preserving forensic evidence are critical steps to ensure effective incident response. Simply restarting services or deleting files without analysis may hinder the investigation and remediation process.
- A. Correct.
Isolating the host prevents it from further communicating with the network or spreading potential malware, making it a critical step in initial containment.
- B. Incorrect.
While terminating suspicious processes may stop the malware temporarily, it does not ensure that the malware is fully removed or prevent future attacks.
- C. Correct.
Capturing a snapshot or backup ensures that evidence is preserved for forensic analysis, which is vital for understanding the attack and preventing future incidents.
- D. Correct.
Blocking outbound traffic from the host can immediately disrupt the malware's communication with its command-and-control server, reducing the risk of further data exfiltration or malicious actions.
- E. Incorrect.
Permanently deleting malware-related files without investigation could result in loss of evidence and failure to fully understand the scope of the attack.