712-50 Question 364
Single answerA global financial services company detects unusual outbound traffic from a database server that stores customer account data. The SOC confirms that an administrator account was used after hours from an unfamiliar source IP, and preliminary logs suggest a large volume of records may have been accessed. The CIO wants the server immediately rebuilt to restore confidence, while legal counsel asks whether the organization can support regulatory reporting and possible litigation. As the CCISO, what is the MOST appropriate next action to determine whether network security policies were breached, assess business impact, and preserve evidence?
- A
Isolate the affected server from the network, activate incident response and forensic procedures, preserve volatile and non-volatile evidence with chain of custody, and correlate logs to determine scope and policy violations before rebuilding.
- B
Allow the server to remain online to avoid disrupting business operations, begin reviewing application logs, and postpone evidence collection until the extent of data loss is confirmed.
- C
Rebuild the server immediately from a known-good image, then use the restored system's logs and antivirus reports to estimate whether any policy violations occurred.
- D
Ask the database team to reset the administrator password and delete suspicious sessions, then conduct a standard internal audit next week to determine whether the event was serious.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to isolate the affected server, preserve evidence, and launch formal incident response and forensic analysis before rebuilding. In a suspected breach involving sensitive customer data, the CCISO must ensure three things happen in parallel: containment, impact assessment, and evidence preservation. This aligns with widely accepted guidance such as NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide, which emphasizes preparation, detection and analysis, containment, eradication, and recovery, with careful evidence handling throughout. It also aligns with forensic best practices reflected in NIST SP 800-86, which stresses collecting and preserving both volatile and persistent data in a manner that supports investigation and potential legal use. From a governance perspective, the CCISO should ensure policy breach analysis includes reviewing access control violations, after-hours privileged use, source IP anomalies, and possible unauthorized data exfiltration. Preserving chain of custody is particularly important in regulated industries such as financial services, where legal, compliance, and reporting obligations may follow. Immediate rebuilding or ad hoc administrative cleanup may restore service faster, but it can irreparably compromise the organization's ability to determine scope, prove what happened, satisfy regulators, and support litigation.
- A. Correct.
Correct. This is the most appropriate executive-level response because it balances containment, investigation, impact assessment, and evidentiary integrity. Isolating the system helps prevent further exfiltration while avoiding premature destruction of evidence. Activating formal incident response and forensic procedures ensures that volatile data such as memory, active connections, and running processes can be collected where appropriate, followed by preservation of disk, log, and network evidence. Maintaining chain of custody is critical if the organization may face regulatory inquiry, litigation, or law enforcement involvement. Correlating logs from the database, authentication systems, endpoints, and network devices helps determine whether network security policies were violated, what data was affected, and the scope of impact before rebuilding or restoring operations.
- B. Incorrect.
Incorrect. Leaving the server online may permit continued attacker activity, further data loss, or alteration of evidence. While business continuity matters, failing to contain a suspected breach is a common mistake. Delaying evidence collection until after confirming data loss is also problematic because valuable volatile evidence may disappear. A candidate might choose this option out of concern for uptime, but incident handling best practice requires timely containment and evidence preservation when compromise is suspected.
- C. Incorrect.
Incorrect. Rebuilding immediately destroys or overwrites important forensic artifacts and undermines the ability to determine what actually happened, whether policies were breached, and what data was accessed. Logs and antivirus reports on a rebuilt system are not a substitute for preserved evidence from the compromised host and related infrastructure. This option reflects a common operational bias toward rapid recovery at the expense of investigation, legal defensibility, and accurate impact assessment.
- D. Incorrect.
Incorrect. Resetting credentials may be part of containment later, but deleting suspicious sessions and waiting for a routine audit can destroy evidence and delay incident response. A standard internal audit is not a replacement for incident investigation and forensic preservation. This option may appeal to those who think administrative correction alone resolves the issue, but it fails to address evidentiary requirements, timely impact analysis, and the need to determine whether security policies and regulatory obligations were triggered.