312-39V2: Certified SOC Analyst v2

Question

You are a SOC analyst on duty when the team receives an alert about a ransomware incident affecting the organization's email infrastructure. The incident response team (IRT) conducts forensic analysis and determines that the ransomware exploited CVE-2024-0123 on an unpatched mail server. The IRT is now actively deploying emergency patch KB5025941, updating mail-filtering rules to block malicious payloads, and implementing additional network segmentation to restrict lateral movement.

Based on this scenario, which phase of the Incident Response process is the SOC currently performing?

Explanation

Containment focuses on limiting an incident’s spread and immediate impact. Blocking malicious payloads and adding network segmentation to restrict lateral movement are containment measures that isolate affected systems and prevent further propagation.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ71

Community Discussion