Objective 4.8: Explain appropriate incident response activities
Security+ SY0-701 practice question
A SOC analyst observes a workstation sending HTTPS traffic to an unknown external IP address every 60 seconds. The incident lead wants to stop the workstation from communicating with any attacker infrastructure while preserving as much forensic evidence as possible. Which of the following should the analyst do FIRST?
- Reimage the workstation from a known-good baseline
Reimaging belongs to eradication and recovery, after evidence has been collected. Doing it first destroys the evidence on the disk and in memory.
- Isolate the workstation from the network(Correct)
Correct. Network isolation stops all communication from the host, not just to one address, while the system stays powered on so volatile evidence is preserved for forensic acquisition.
- Power off the workstation
Powering off stops the traffic but erases volatile evidence such as memory contents, running processes, and network connections, which may hold the malware's keys or configuration.
- Block the external IP address at the perimeter firewall
Blocking one IP address stops only one destination. Malware commonly rotates or falls back to other command-and-control addresses or domains, and the host remains able to spread internally.
Explanation
Regular, timed connections to an unknown address (beaconing) suggest command-and-control traffic. The first goal is containment: stop the host from communicating while keeping evidence intact. Isolating the workstation from the network, for example through EDR network containment or by moving its switch port to a quarantine VLAN, cuts off all command-and-control channels while the system keeps running, so volatile evidence such as memory, running processes, and active connections can still be collected.