712-50 Question 365
Single answerA global manufacturer detects unusually large outbound transfers from an engineering file server to an external IP address over HTTPS during non-business hours. The server contains product design files classified as highly confidential. The SOC lead wants to immediately log in to the server, delete suspicious files, and disable several services to stop the activity. As the CISO, you must determine whether network security policy has been breached, assess business impact, and preserve evidence for possible legal action. What is the MOST appropriate immediate course of action?
- A
Authorize the SOC to remove suspicious files and reconfigure the server immediately, then collect logs afterward to minimize operational risk
- B
Direct the incident response team to isolate the server from the network in a way that preserves volatile and persistent evidence, initiate chain-of-custody procedures, and analyze relevant logs and data flows against policy and data classification requirements
- C
Allow the traffic to continue until the team can confirm exfiltration with certainty, because premature containment could destroy evidence and create false positives
- D
Have the system administrator reboot the server into maintenance mode, run antivirus scans, and restore the most recent clean backup before notifying legal or compliance teams
Show answer and explanation
Correct answer: B
Explanation
The best answer is to isolate the affected asset in a forensically sound manner, preserve evidence, and then determine whether policy was violated by correlating technical findings with business rules such as data classification, authorized network flows, egress restrictions, and access control requirements. At the executive level, the CISO must ensure incident response aligns with both operational needs and legal defensibility. A likely policy breach exists here because highly confidential engineering data appears to be leaving the network outside approved patterns. The organization must quickly assess scope, sensitivity of the potentially exposed information, affected systems, duration, users involved, and regulatory or contractual implications.
This approach aligns with established best practices in incident handling and digital evidence management, including NIST SP 800-61 Rev. 2 on Computer Security Incident Handling, which emphasizes detection, analysis, containment, eradication, and recovery while preserving evidence; and NIST SP 800-86, which addresses integrating forensic techniques into incident response. Chain-of-custody procedures, time synchronization, log preservation, and controlled containment are also consistent with common forensic and legal practices. From a CCISO perspective, the key leadership decision is not merely technical containment, but ensuring that business impact assessment, policy validation, legal readiness, and evidence preservation occur together in a disciplined response.
- A. Incorrect.
This is incorrect because it prioritizes rapid remediation over evidence preservation and proper incident handling. Deleting files and changing configurations before capturing volatile data, network connections, and relevant logs can destroy or alter evidence needed to determine whether policy was breached and what data was affected. It also weakens the organization's ability to support disciplinary, regulatory, insurance, or legal action.
- B. Correct.
This is correct because it balances containment, impact assessment, and forensic integrity. Isolation is appropriate to stop potential exfiltration, but it should be performed in a controlled manner that preserves volatile evidence where feasible, such as active connections, memory state, running processes, and network session details. Initiating chain of custody supports admissibility and defensibility of evidence. Reviewing firewall, proxy, EDR, DLP, VPN, and server logs against approved network use, egress controls, and data classification policies is the right way to determine whether security policy was breached and assess the scope and business impact.
- C. Incorrect.
This is incorrect because waiting for complete certainty can allow continued data loss, larger business impact, and further policy violations. While preserving evidence is important, incident response best practice does not require allowing ongoing exfiltration. A controlled containment action, coordinated with forensics and legal requirements, is more appropriate than delaying action.
- D. Incorrect.
This is incorrect because rebooting, scanning, and restoring too early can overwrite volatile evidence and obscure root cause, attacker methods, and scope. It also skips critical governance steps such as evidence handling, breach assessment, and appropriate notification to legal, compliance, and leadership. Backups and malware scans may be part of later recovery, but they are not the best immediate action when a potential policy breach and data exfiltration are still under investigation.