SY0-701 Question 387
Single answerProcess: Preparation , Detection , Analysis , Containment , Eradication , Recovery , Lessons learned , TrainingA security analyst discovers that several employee workstations are communicating with a known malicious command-and-control domain. After reviewing endpoint telemetry, the incident response team confirms malware infection on eight systems. The team immediately isolates the affected hosts from the network, preserves forensic images, and blocks the domain at the firewall. Management now wants to know what action should occur next to align with a standard incident response process and reduce the chance of reinfection.
Which of the following is the BEST next step?
- A
Rebuild or clean the affected systems, remove the malware and persistence mechanisms, and validate that the threat has been eliminated before returning hosts to service
- B
Conduct a lessons-learned meeting with stakeholders to identify communication gaps and update playbooks before touching the infected systems
- C
Provide organization-wide phishing awareness training immediately so users can recognize the attack vector that caused the compromise
- D
Restore the affected systems to production first so business operations can resume, and then investigate whether the malware is still present
Show answer and explanation
Correct answer: A
Explanation
This question tests understanding of the incident response lifecycle: preparation, detection, analysis, containment, eradication, recovery, and lessons learned, with training often supporting both preparation and post-incident improvement. In the scenario, the organization has already completed detection and analysis by identifying the malicious domain and confirming infection. It has also performed containment by isolating hosts and blocking the domain, while preserving evidence to support investigation. The best next step is eradication: remove the malware, eliminate persistence, remediate the root cause, and validate that the systems are no longer compromised. Only then should the organization proceed to recovery by returning systems to service in a controlled manner. After recovery, the team should conduct lessons learned and update training, procedures, and controls. This sequence aligns with common incident handling guidance such as NIST SP 800-61 Computer Security Incident Handling Guide, which emphasizes containment, eradication, recovery, and post-incident activity in that order.
- A. Correct.
Correct. The scenario shows that detection, analysis, and initial containment have already occurred: the team identified malicious traffic, confirmed infection, isolated systems, preserved evidence, and blocked the malicious domain. The next incident response phase is eradication, followed by recovery. In practice, this means removing malware, deleting persistence mechanisms such as scheduled tasks or registry run keys, patching any exploited vulnerabilities, and validating through rescans or EDR monitoring that the systems are clean before they are restored to normal operations.
- B. Incorrect.
Incorrect. A lessons-learned meeting is an important part of the incident response lifecycle, but it occurs after containment, eradication, and recovery activities are completed or stabilized. Holding it now would delay technical remediation and increase the risk that the malware remains on the affected systems.
- C. Incorrect.
Incorrect. Training is valuable and may be appropriate later if the root cause involved phishing or user error, but it is not the best immediate next step while compromised systems still require eradication. Incident response prioritizes removing the threat and safely restoring operations before longer-term improvement activities.
- D. Incorrect.
Incorrect. Restoring systems to production before confirming malware removal is a common but serious mistake. That would skip eradication and could allow the attacker to regain access, spread laterally, or trigger recurring alerts. Recovery should occur only after the organization verifies that the threat has been removed.