SY0-701 Question 385
Single answer4.8 Explain appropriate incident response activities.A security analyst receives multiple alerts indicating that a finance department workstation is communicating with a known command-and-control IP address and is attempting to encrypt files on a shared drive. The analyst confirms suspicious processes are running on the workstation and that other hosts have not yet shown similar behavior. The organization's incident response plan emphasizes minimizing business impact while preserving evidence for investigation. What should the analyst do FIRST?
- A
Immediately wipe and reimage the workstation to stop the attack
- B
Disconnect the workstation from the network to contain the incident and preserve volatile evidence for collection
- C
Shut down the workstation to prevent any additional file encryption
- D
Notify all employees that ransomware is spreading and instruct them to power off their systems
Show answer and explanation
Correct answer: B
Explanation
The best answer is to disconnect the workstation from the network to contain the threat while preserving volatile evidence. In the incident response lifecycle, once an incident is identified, the first operational priority is typically containment to limit damage and prevent spread. Because the scenario specifically mentions preserving evidence, the analyst should avoid actions such as wiping or shutting down the host before collecting appropriate forensic data. This aligns with common incident response guidance from NIST SP 800-61 Computer Security Incident Handling Guide, which emphasizes containment strategies that balance operational impact with evidence preservation and support later eradication and recovery steps.
- A. Incorrect.
This is incorrect because wiping and reimaging is an eradication and recovery action, not the first step once the incident is confirmed. Doing so immediately would destroy valuable forensic evidence such as running processes, network connections, memory contents, and artifacts needed to understand scope and root cause. Incident response best practices prioritize containment and evidence preservation before eradication.
- B. Correct.
This is correct because the most appropriate first action is containment: isolate the affected workstation from the network to stop further command-and-control communication and reduce the chance of lateral movement or additional encryption of network resources. At the same time, the system should be kept available for volatile evidence collection, such as memory and active process data, because the incident response plan specifically requires preserving evidence while minimizing impact.
- C. Incorrect.
This is incorrect because powering off the workstation may stop the malicious activity, but it can also destroy volatile evidence stored in memory, including encryption processes, malware payloads, network sessions, and decryption keys that may assist the investigation. In many cases, isolating the host from the network is preferred over immediate shutdown when evidence preservation is important.
- D. Incorrect.
This is incorrect because this response is overly broad and premature based on the scenario. The analyst has evidence of one compromised workstation, but no confirmation yet that ransomware is spreading across the environment. Instructing all employees to power off systems could create unnecessary business disruption and would not be the first targeted containment action called for by the incident response plan.