- Which containment action is most effective under these conditions?
Answer: Use endpoint isolation immediately, retain the management channel, and separately invalidate any credentials exposed on the laptop.
When an endpoint is actively communicating with a command-and-control domain, you're dealing with a live incident that demands immediate, targeted containment — not a scheduled fix or a workaround that shifts the problem elsewhere. The key principle here is isolate the threat, preserve visibility, and address credential exposure — all without losing control of the asset.
Answer B achieves exactly this. Endpoint isolation cuts off the malicious C2 communication immediately, while retaining the management channel keeps the security team in control of the device — they can push commands, collect forensic data, and monitor behavior remotely. Separately invalidating exposed credentials closes the door on lateral movement even if the attacker already harvested them.
Answer A fails on two counts: the laptop isn't at the office, so disabling a switch port does nothing to the active threat, and waiting until a "maintenance window" to revoke certificates is dangerously slow during a live compromise.
Answer C only blocks the domain at the corporate perimeter, which is useless since the laptop is operating outside the corporate network entirely — it never touches that perimeter. Telling the employee to avoid the VPN also eliminates a future recovery path.
Answer D is tempting because it sounds cautious, but powering off the home router severs your management channel and may destroy volatile memory evidence. Leaving the laptop "running but disconnected" means no containment and no visibility — the worst of both worlds.
Your study tip: on incident response questions, always trace the actual network path of the affected device. Perimeter controls only help if the device is behind that perimeter.
- What is the most appropriate immediate network containment decision?
Answer: Quarantine the entire affected VLAN at its boundary, while preserving a tightly controlled path for incident-response access.
When you encounter an incident-response containment question, think in terms of scope calibration: contain aggressively enough to stop spread, but not so broadly that you disrupt unaffected systems or cut off your own access to investigate.
Here, the telemetry gives you critical signals — active file encryption on seven hosts, unidentified systems probing via SMB, and partial failure of host-level isolation commands. SMB lateral movement is a hallmark of ransomware propagation, and those unidentified systems suggest the infection boundary is unclear. This means the entire departmental VLAN is a live threat zone, not just the seven confirmed hosts. Option A correctly treats the VLAN boundary as the containment perimeter, blocking further east-west spread while deliberately preserving a controlled IR access path — essential because you still need visibility and remediation capability inside the VLAN.
Option B is tempting but dangerous. Isolating only the seven confirmed workstations ignores the unidentified SMB sources, which are actively probing and likely already compromised. Waiting for confirmation on every host while attackers move freely is a critical response failure. Option C overcorrects badly — disconnecting all VLANs enterprise-wide is a drastic, business-disrupting action unsupported by the evidence, which shows no cross-VLAN traffic yet. This violates the principle of proportional response. Option D is the weakest choice: blocking SMB only on confirmed hosts while leaving the rest of the VLAN unrestricted does almost nothing to stop ongoing lateral movement from the unidentified systems.
For exam strategy, remember: VLAN-boundary containment with preserved IR access is the standard answer when a threat is confirmed within a segment but not yet confirmed beyond it.
- Which credential-reset scope is most appropriate as the initial containment action?
Answer: Reset and revoke sessions for the 18 users with confirmed submissions, then expand the scope if investigation identifies additional exposure.
When you encounter incident response containment questions, think in terms of proportionality and evidence: your action scope should match what the evidence actually confirms, while still allowing for rapid escalation if more exposure surfaces.
The proxy logs give you clear, forensic evidence of exactly 18 users who submitted credentials to the attacker's page. Those accounts are definitively compromised and require immediate reset and session revocation — that's your confirmed blast radius. Resetting those 18 accounts first eliminates the highest-certainty risk without disrupting hundreds of unaffected employees, satisfying the scenario's goal of rapid containment without an unnecessary enterprise-wide outage. Crucially, "then expand if investigation identifies additional exposure" keeps the door open for escalation, making A both precise and adaptive.
Choice B is wrong because opening an email — even a phishing email — does not transmit credentials. No data was submitted by those 400 users, so resetting their accounts conflates risk with confirmed harm and creates unnecessary disruption without security benefit.
Choice C represents a dangerous wait-and-see fallacy. Submitted credentials are already in attacker hands; you don't need to observe active exploitation before acting. By the time you see a successful attacker login, damage is already occurring.
Choice D applies the nuclear option without justification. A broad enterprise-wide reset is a last resort when the scope of compromise is unknown or uncontrollable — here, you have precise forensic scoping from proxy logs.
Your study tip: on incident response questions, evidence quality drives action scope. Confirmed exposure = immediate action; suspected exposure = monitor and investigate; speculative exposure = don't disrupt.
- Which containment strategy best balances security and patient-safety requirements?
Answer: Apply a restrictive network policy allowing only the required clinical servers and incident-response management, while blocking all other destinations.
When you encounter incident-response questions involving critical infrastructure or medical devices, the guiding principle is containment without causing additional harm. You're essentially balancing two competing obligations: stopping the threat and preserving life-critical operations. The right framework here is minimum necessary disruption — isolate the threat as tightly as possible without removing essential functionality.
Option C achieves exactly this. Since the firewall can enforce destination-specific rules immediately, you can surgically restrict the device to communicate only with its two legitimate clinical servers plus incident-response management. The malicious external traffic is blocked, the clinical procedure continues safely, and your security team retains visibility. This is textbook network-layer containment — precise, fast, and proportionate.
Option A fails because passive logging does nothing to stop the active exfiltration or lateral movement. Watching a threat unfold in real time without acting on it isn't containment — it's observation. Option B prioritizes security absolutism over patient safety. While physical isolation is sometimes necessary, cutting a device mid-procedure could directly harm the patient, and a less disruptive technical control is clearly available. That makes immediate disconnection disproportionate here. Option D is doubly flawed: resetting all clinical credentials is an unnecessarily broad action that disrupts legitimate users, and blocking only the currently observed external address leaves the attacker free to pivot to a different destination — a classic perimeter-only thinking trap.
For the exam, remember this pattern: when a targeted technical control can achieve containment, it beats both "do nothing and log" and "burn it all down." Precision always wins over passive monitoring or nuclear options when lives are involved.
- Which action best addresses both containment needs?
Answer: Restrict the server's communications to required services and response tools, then reset the exposed account from the clean privileged workstation.
When handling a compromised system that must stay online, you need to think in two parallel tracks: stop the bleeding on the network and perform privileged actions from a trusted environment. The order and location of those actions matter enormously.
Option B is correct because it sequences both controls properly. First, restricting the server's communications limits what an attacker can do with any stolen credentials right now — they can't reach other systems or exfiltrate data freely. Then, resetting the exposed domain-admin account from the clean privileged-access workstation ensures the reset credentials themselves aren't immediately re-harvested by the malware still running on the compromised server. You've contained the threat at the network layer and invalidated the stolen credential without introducing new ones into a hostile environment.
Option A fails on a critical point: resetting the domain-admin password from the compromised server means typing new credentials into a machine that has credential-dumping malware. You'd be handing the attacker a fresh set of keys while thinking you changed the locks. The network restriction part is valid, but the execution location is the fatal flaw.
Option C ignores the network containment step entirely, leaving the server fully connected. Monitoring whether the new password is used is a detective control — useful, but it doesn't prevent lateral movement before detection occurs.
Option D over-corrects. Powering off a business-critical server and delaying the account reset prioritizes forensics over active threat containment, leaving a known compromised credential valid and unaddressed.
Your study tip: on incident response questions, always ask where a privileged action is performed, not just what the action is. A clean workstation exists precisely so you never trust a compromised host with sensitive credentials.
- Containment limits an incident's spread without removing its root cause. Which action is containment?
Answer: Blocking the malware's C2 domain at DNS
Blocking the command-and-control domain stops the attacker from steering the malware, but the malware is still present. That makes it containment. Deleting the malware is tempting, but removing the threat itself is eradication.
- Ransomware is encrypting files on one workstation and spreading through shared drives. What is the best first containment step?
Answer: Disconnect the workstation from the network
Disconnecting the infected workstation stops it from reaching shared drives, which halts the spread. Restoring from backup is tempting, but while the infection is still active, restored files can simply be encrypted again.
- Which containment strategy most appropriately reflects the credential's exposure scope?
Answer: Isolate the compromised endpoint and rotate the local administrator credential across all endpoints, assigning unique passwords to each system to eliminate the shared-secret exposure.
When a shared credential is compromised, the exposure scope isn't limited to the single endpoint where the attacker extracted it — it extends to every system that accepts that credential. This is the core concept being tested: lateral movement risk from shared secrets. Your containment strategy must match the actual attack surface, not just the confirmed damage.
Option C correctly reflects this principle. Isolating the compromised endpoint stops immediate attacker access from that machine, while rotating the local administrator password across all 600 endpoints — and assigning unique passwords to each — eliminates the shared-secret vulnerability entirely. The absence of confirmed compromise on other systems is irrelevant; the attacker already has the keys to all of them.
Option A is the most tempting trap. It feels proportional — only one endpoint is confirmed compromised, so why disrupt 599 others? But this reasoning ignores that the credential itself is the exposure. Changing the password on only one endpoint while 599 systems still share the extracted password leaves the entire fleet vulnerable.
Option B delays the critical password rotation behind forensic analysis, during which time the attacker retains valid administrative access to every endpoint in the organization. Disabling RDP alone doesn't revoke the credential — attackers have other lateral movement techniques.
Option D addresses the wrong account entirely. The threat here is the local administrator account, not a domain user account. Resetting a domain password does nothing to contain a compromised local credential.
For exam questions involving credential compromise, always ask yourself: what is the true blast radius of this secret? That scope defines your containment boundary, not just confirmed victim systems.
- After a breach, the SOC disables a service account, rotates its API keys, and invalidates its tokens. What is the main containment goal?
Answer: Cutting off the attacker's authenticated access
Disabling the account, rotating keys and invalidating tokens all remove ways to log in as that identity. This is credential-based containment. Removing the vulnerability is tempting, but these steps leave the original entry point unpatched.
- A user's VPN password was phished, and the attacker has an active VPN session right now. Which action best contains the threat?
Answer: Revoke active sessions and reset the password
The attacker holds a live session and a valid password, so both must be cut off: revoke sessions and reset the password. Requiring MFA at the next login is tempting, but it does nothing about the session the attacker already has open.
- An analyst moves an infected laptop to a quarantine VLAN that can reach only security tools. Which strategy is this?
Answer: Network isolation of the host
A quarantine VLAN isolates the host so it cannot reach other systems, which is network isolation. Eradication is tempting, but the malware is still on the laptop. Isolation only limits its reach.
- Which statement best describes the containment gap?
Answer: Credential and session containment succeeded, but attacker-created server-side persistence must also be removed or disabled.
When investigating a mailbox compromise, you need to think in layers of attacker persistence. Resetting credentials and revoking sessions removes the attacker's access, but it does nothing about configurations the attacker already created inside the environment. That distinction is the heart of this question.
The scenario confirms that password reset and session revocation worked — the attacker can no longer log in. Yet emails keep flowing to an external address because the attacker planted server-side artifacts (an inbox rule and a forwarding configuration) that the mail server executes autonomously, with no ongoing attacker involvement. D correctly identifies this gap: credential and session containment succeeded, but the attacker's persistent server-side mechanisms must be explicitly found and removed.
A is wrong because it makes a false absolute claim — credential resets can contain cloud-based compromises. The problem here isn't the reset's effectiveness; it's that the reset doesn't touch rules and configurations.
B is a distractor that overstates the solution. Network isolation is a drastic measure unnecessary here, and the premise — that account-level controls "cannot" stop server-side processing — is false. Removing the malicious rules is an account-level action that resolves the problem.
C is wrong because the passage tells you sessions were already revoked. Waiting for a cache to expire implies the session revocation failed, which contradicts the scenario.
Study tip: On incident-response questions, always ask yourself: Did the attacker leave anything behind that acts independently? Rules, scheduled tasks, OAuth grants, and forwarding configs persist after credential resets — containment isn't complete until those artifacts are purged.
- What additional containment action most directly addresses why access continued?
Answer: Revoke the application's consent and associated refresh tokens, terminate active sessions, and review other grants issued by the user.
When a malicious OAuth application gains access to a cloud mailbox, you need to understand how OAuth authentication works to contain it properly. OAuth separates authorization from passwords — an approved application receives tokens (a short-lived access token and a long-lived refresh token) that operate independently of the user's password. Changing the password revokes the user's own session credentials, but it does not invalidate tokens already issued to third-party applications. That's exactly why the audit logs showed continued access after the password change.
A is correct because it attacks the actual persistence mechanism. Revoking the application's consent cancels the grant that authorized the app in the first place, and explicitly invalidating the refresh tokens prevents the app from minting new access tokens. Reviewing other grants closes the door on similar hidden footholds the same user may have approved.
B is wrong because password length is irrelevant here — the application never needed the password to begin with. Restarting endpoints addresses endpoint-level sessions, not cloud-side OAuth tokens.
C is wrong for two reasons: isolating the workstation doesn't affect cloud-to-cloud token usage (the malicious app talks directly to the mail API, not through the user's device), and waiting for natural token expiration could mean hours or days of continued unauthorized access — unacceptable during active containment.
D is wrong because disabling external forwarding targets a different attack vector. Retaining the malicious consent grant specifically so it can be "examined later" leaves the threat active and defeats the purpose of containment entirely.
Your study tip: on OAuth incident questions, always ask "what did the password change actually revoke?" If tokens were issued before the change, assume they're still valid until explicitly revoked.
- Which sequence of actions is the most appropriate immediate containment strategy?
Answer: Quarantine the workstation while retaining management access, then reset the privileged account from a known-clean administrative system and revoke its sessions.
When you see a containment scenario involving a potentially compromised privileged account, you need to think about two simultaneous risks: stopping the attacker's active access while ensuring your own remediation actions aren't being monitored or intercepted by the same attacker.
The core principle here is that you should never perform credential resets from a system you suspect is compromised. If malware is maintaining a command-and-control session, it may have keylogging or credential-harvesting capabilities active. Any password reset performed on that workstation hands the new credentials directly to the attacker — defeating the entire purpose of the reset. Answer B correctly sequences the response: first quarantine the workstation (cutting the C2 channel) while preserving management access so analysts can investigate, then reset the privileged account from a known-clean system and revoke all active sessions. This protects the new credentials while maintaining investigative continuity.
Answer A fails because it performs the account reset from the affected workstation itself, meaning the attacker's malware could capture the newly issued credentials before quarantine is applied — the exact scenario the organization is trying to prevent.
Answer C introduces unnecessary delay by waiting for forensic imaging to complete before resetting the compromised privileged account. Every minute that account remains active is a window for lateral movement. Imaging and remediation can proceed in parallel.
Answer D misidentifies the scope of the problem. Disabling the finance user's account and blocking the C2 address addresses symptoms, not the privileged account that was exposed. Deferring that reset until eradication leaves an elevated, potentially stolen account active throughout the entire investigation.
Your study tip: on incident response questions, always ask yourself from where and in what order actions are being taken — sequence and execution context matter as much as the actions themselves.
- Which action best contains the credential exposure while minimizing avoidable operational impact?
Answer: Rotate the service-account password, update all authorized secret stores in a coordinated change, and terminate existing account sessions.
When a credential is confirmed exposed, your goal is to balance two competing pressures: stopping the attacker's access and preserving business continuity. The right move neutralizes the threat immediately without creating unnecessary downtime — and that's exactly the lens you should apply here.
Rotating the password and simultaneously updating all dependent secret stores (C) achieves both goals at once. The exposed credential becomes worthless the moment it changes, cutting off any attacker leveraging it. Because the scenario tells you administrators can update secret stores within minutes, a coordinated rotation causes minimal disruption. Terminating existing sessions closes any active connections that authenticated with the old, compromised password — a critical step often overlooked.
Choice A is operationally reckless. Disabling the account immediately breaks all three applications right now, harming customers, when a less disruptive path exists. Waiting for "complete eradication" before restoring service also creates extended downtime with no security advantage over a password rotation.
Choice B is dangerously passive. Removing interactive sign-in rights doesn't address the actual threat: the password itself is what the malware exposed. Attackers can still use that password programmatically to authenticate without interactive login. Deferring action until a maintenance window gives attackers a free runway.
Choice D compounds the problem. It leaves the exposed credential active and in use, meaning the attacker's stolen password remains valid. Creating a parallel account doesn't contain the breach — it just adds complexity while the vulnerability persists.
Study tip: On incident-response questions, watch for answers that trade a definite security fix for an uncertain convenience. If the scenario tells you disruption can be avoided with a coordinated action, that's your signal — choose containment with continuity, not instead of it.
