Cyber Security Quiz: Containment Strategies
10 questions · exam conditions
0:00
Containment StrategiesQuestion 1 of 10

An analyst confirms that a finance workstation is maintaining an active command-and-control session. Ten minutes earlier, an administrator used a privileged domain account to troubleshoot the workstation. The organization wants to contain the incident without allowing newly issued credentials to be captured.

Which sequence of actions is the most appropriate immediate containment strategy?

Reset the privileged account from the affected workstation, revoke its sessions, and then place the workstation in a quarantine network.
Quarantine the workstation while retaining management access, then reset the privileged account from a known-clean administrative system and revoke its sessions.
Power off the workstation, wait for forensic imaging to finish, and then reset the privileged account from the standard user help desk.
Disable the finance user's account, block the command-and-control address, and defer the privileged account reset until eradication is complete.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Containment Strategies

Practice Containment Strategies in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Containment Strategies, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

An analyst confirms that a finance workstation is maintaining an active command-and-control session. Ten minutes earlier, an administrator used a privileged domain account to troubleshoot the workstation. The organization wants to contain the incident without allowing newly issued credentials to be captured.

Which sequence of actions is the most appropriate immediate containment strategy?

  1. Reset the privileged account from the affected workstation, revoke its sessions, and then place the workstation in a quarantine network.
  2. Quarantine the workstation while retaining management access, then reset the privileged account from a known-clean administrative system and revoke its sessions. (correct answer)
  3. Power off the workstation, wait for forensic imaging to finish, and then reset the privileged account from the standard user help desk.
  4. Disable the finance user's account, block the command-and-control address, and defer the privileged account reset until eradication is complete.
Explanation: When you see a containment scenario involving a potentially compromised privileged account, you need to think about two simultaneous risks: stopping the attacker's active access while ensuring your own remediation actions aren't being monitored or intercepted by the same attacker. The core principle here is that you should never perform credential resets from a system you suspect is compromised. If malware is maintaining a command-and-control session, it may have keylogging or credential-harvesting capabilities active. Any password reset performed on that workstation hands the new credentials directly to the attacker — defeating the entire purpose of the reset. Answer B correctly sequences the response: first quarantine the workstation (cutting the C2 channel) while preserving management access so analysts can investigate, then reset the privileged account from a known-clean system and revoke all active sessions. This protects the new credentials while maintaining investigative continuity. Answer A fails because it performs the account reset from the affected workstation itself, meaning the attacker's malware could capture the newly issued credentials before quarantine is applied — the exact scenario the organization is trying to prevent. Answer C introduces unnecessary delay by waiting for forensic imaging to complete before resetting the compromised privileged account. Every minute that account remains active is a window for lateral movement. Imaging and remediation can proceed in parallel. Answer D misidentifies the scope of the problem. Disabling the finance user's account and blocking the C2 address addresses symptoms, not the privileged account that was exposed. Deferring that reset until eradication leaves an elevated, potentially stolen account active throughout the entire investigation. Your study tip: on incident response questions, always ask yourself from where and in what order actions are being taken — sequence and execution context matter as much as the actions themselves.

Question 2

A network-connected medical device is sending traffic to an unapproved external address. Disconnecting the device would interrupt an active clinical procedure. The device normally communicates only with two internal clinical servers, and a network firewall can enforce destination-specific rules immediately.

Which containment strategy best balances security and patient-safety requirements?

  1. Leave the device fully connected until the procedure ends, while increasing logging for all traffic generated by the device.
  2. Disconnect the device immediately, because complete physical isolation takes priority over operational requirements during an incident.
  3. Apply a restrictive network policy allowing only the required clinical servers and incident-response management, while blocking all other destinations. (correct answer)
  4. Reset every clinical user's credentials and block only the currently observed external address at the internet perimeter.
Explanation: When you encounter incident-response questions involving critical infrastructure or medical devices, the guiding principle is containment without causing additional harm. You're essentially balancing two competing obligations: stopping the threat and preserving life-critical operations. The right framework here is minimum necessary disruption — isolate the threat as tightly as possible without removing essential functionality. Option C achieves exactly this. Since the firewall can enforce destination-specific rules immediately, you can surgically restrict the device to communicate only with its two legitimate clinical servers plus incident-response management. The malicious external traffic is blocked, the clinical procedure continues safely, and your security team retains visibility. This is textbook network-layer containment — precise, fast, and proportionate. Option A fails because passive logging does nothing to stop the active exfiltration or lateral movement. Watching a threat unfold in real time without acting on it isn't containment — it's observation. Option B prioritizes security absolutism over patient safety. While physical isolation is sometimes necessary, cutting a device mid-procedure could directly harm the patient, and a less disruptive technical control is clearly available. That makes immediate disconnection disproportionate here. Option D is doubly flawed: resetting all clinical credentials is an unnecessarily broad action that disrupts legitimate users, and blocking only the currently observed external address leaves the attacker free to pivot to a different destination — a classic perimeter-only thinking trap. For the exam, remember this pattern: when a targeted technical control can achieve containment, it beats both "do nothing and log" and "burn it all down." Precision always wins over passive monitoring or nuclear options when lives are involved.

Question 3

A phishing page collected credentials from employees. Proxy logs identify 18 users who submitted data, while 400 other users only opened the message. No evidence indicates that the remaining workforce interacted with the page. The organization wants rapid containment without creating an unnecessary enterprise-wide outage.

Which credential-reset scope is most appropriate as the initial containment action?

  1. Reset and revoke sessions for the 18 users with confirmed submissions, then expand the scope if investigation identifies additional exposure. (correct answer)
  2. Reset accounts for all 418 recipients, because opening a phishing message is equivalent to disclosing authentication credentials.
  3. Reset only accounts that show successful attacker logins, because submitted credentials pose no risk until observed in use.
  4. Reset every workforce account, because a phishing event makes selective credential containment inherently unreliable.
Explanation: When you encounter incident response containment questions, think in terms of proportionality and evidence: your action scope should match what the evidence actually confirms, while still allowing for rapid escalation if more exposure surfaces. The proxy logs give you clear, forensic evidence of exactly 18 users who submitted credentials to the attacker's page. Those accounts are definitively compromised and require immediate reset and session revocation — that's your confirmed blast radius. Resetting those 18 accounts first eliminates the highest-certainty risk without disrupting hundreds of unaffected employees, satisfying the scenario's goal of rapid containment without an unnecessary enterprise-wide outage. Crucially, "then expand if investigation identifies additional exposure" keeps the door open for escalation, making A both precise and adaptive. Choice B is wrong because opening an email — even a phishing email — does not transmit credentials. No data was submitted by those 400 users, so resetting their accounts conflates risk with confirmed harm and creates unnecessary disruption without security benefit. Choice C represents a dangerous wait-and-see fallacy. Submitted credentials are already in attacker hands; you don't need to observe active exploitation before acting. By the time you see a successful attacker login, damage is already occurring. Choice D applies the nuclear option without justification. A broad enterprise-wide reset is a last resort when the scope of compromise is unknown or uncontrollable — here, you have precise forensic scoping from proxy logs. Your study tip: on incident response questions, evidence quality drives action scope. Confirmed exposure = immediate action; suspected exposure = monitor and investigate; speculative exposure = don't disrupt.

Question 4

Seven workstations in one departmental VLAN begin encrypting files within minutes. Network telemetry shows ongoing SMB connection attempts from several unidentified systems in that VLAN. No suspicious traffic has yet been observed in other VLANs. Host-level isolation commands are reaching some systems but not others.

What is the most appropriate immediate network containment decision?

  1. Quarantine the entire affected VLAN at its boundary, while preserving a tightly controlled path for incident-response access. (correct answer)
  2. Isolate only the seven confirmed workstations, because broader containment is unjustified without confirmed malware on every system.
  3. Disconnect all organizational VLANs from one another, because file encryption indicates enterprise-wide compromise by default.
  4. Block SMB only on the seven confirmed workstations, while leaving all other traffic within the departmental VLAN unrestricted.
Explanation: When you encounter an incident-response containment question, think in terms of scope calibration: contain aggressively enough to stop spread, but not so broadly that you disrupt unaffected systems or cut off your own access to investigate. Here, the telemetry gives you critical signals — active file encryption on seven hosts, unidentified systems probing via SMB, and partial failure of host-level isolation commands. SMB lateral movement is a hallmark of ransomware propagation, and those unidentified systems suggest the infection boundary is unclear. This means the entire departmental VLAN is a live threat zone, not just the seven confirmed hosts. Option A correctly treats the VLAN boundary as the containment perimeter, blocking further east-west spread while deliberately preserving a controlled IR access path — essential because you still need visibility and remediation capability inside the VLAN. Option B is tempting but dangerous. Isolating only the seven confirmed workstations ignores the unidentified SMB sources, which are actively probing and likely already compromised. Waiting for confirmation on every host while attackers move freely is a critical response failure. Option C overcorrects badly — disconnecting all VLANs enterprise-wide is a drastic, business-disrupting action unsupported by the evidence, which shows no cross-VLAN traffic yet. This violates the principle of proportional response. Option D is the weakest choice: blocking SMB only on confirmed hosts while leaving the rest of the VLAN unrestricted does almost nothing to stop ongoing lateral movement from the unidentified systems. For exam strategy, remember: VLAN-boundary containment with preserved IR access is the standard answer when a threat is confirmed within a segment but not yet confirmed beyond it.

Question 5

After a mailbox compromise, the security team resets the user's password and revokes all active sessions. Minutes later, messages are still being copied to an external address. Investigation finds a hidden inbox rule and a newly registered mail-forwarding configuration.

Which statement best describes the containment gap?

  1. The password reset was ineffective because credential resets cannot contain attacks against cloud-based email accounts.
  2. The mailbox must be network-isolated, because account-level controls cannot stop server-side message processing.
  3. The attacker retained the old session, so waiting for the session cache to expire is the required next step.
  4. Credential and session containment succeeded, but attacker-created server-side persistence must also be removed or disabled. (correct answer)
Explanation: When investigating a mailbox compromise, you need to think in layers of attacker persistence. Resetting credentials and revoking sessions removes the attacker's access, but it does nothing about configurations the attacker already created inside the environment. That distinction is the heart of this question. The scenario confirms that password reset and session revocation worked — the attacker can no longer log in. Yet emails keep flowing to an external address because the attacker planted server-side artifacts (an inbox rule and a forwarding configuration) that the mail server executes autonomously, with no ongoing attacker involvement. D correctly identifies this gap: credential and session containment succeeded, but the attacker's persistent server-side mechanisms must be explicitly found and removed. A is wrong because it makes a false absolute claim — credential resets can contain cloud-based compromises. The problem here isn't the reset's effectiveness; it's that the reset doesn't touch rules and configurations. B is a distractor that overstates the solution. Network isolation is a drastic measure unnecessary here, and the premise — that account-level controls "cannot" stop server-side processing — is false. Removing the malicious rules is an account-level action that resolves the problem. C is wrong because the passage tells you sessions were already revoked. Waiting for a cache to expire implies the session revocation failed, which contradicts the scenario. Study tip: On incident-response questions, always ask yourself: Did the attacker leave anything behind that acts independently? Rules, scheduled tasks, OAuth grants, and forwarding configs persist after credential resets — containment isn't complete until those artifacts are purged.

Question 6

A user approved a malicious OAuth application that obtained long-lived access to the user's cloud mailbox. The user has changed the account password, but audit logs show that the application accessed mail again after the change.

What additional containment action most directly addresses why access continued?

  1. Revoke the application's consent and associated refresh tokens, terminate active sessions, and review other grants issued by the user. (correct answer)
  2. Change the password a second time using a longer value, then require the user to restart every managed endpoint.
  3. Isolate the user's primary workstation from the network, then wait for the application's current access token to expire naturally.
  4. Disable external email forwarding at the tenant level, then retain the application's consent for later forensic examination.
Explanation: When a malicious OAuth application gains access to a cloud mailbox, you need to understand how OAuth authentication works to contain it properly. OAuth separates authorization from passwords — an approved application receives tokens (a short-lived access token and a long-lived refresh token) that operate independently of the user's password. Changing the password revokes the user's own session credentials, but it does not invalidate tokens already issued to third-party applications. That's exactly why the audit logs showed continued access after the password change. A is correct because it attacks the actual persistence mechanism. Revoking the application's consent cancels the grant that authorized the app in the first place, and explicitly invalidating the refresh tokens prevents the app from minting new access tokens. Reviewing other grants closes the door on similar hidden footholds the same user may have approved. B is wrong because password length is irrelevant here — the application never needed the password to begin with. Restarting endpoints addresses endpoint-level sessions, not cloud-side OAuth tokens. C is wrong for two reasons: isolating the workstation doesn't affect cloud-to-cloud token usage (the malicious app talks directly to the mail API, not through the user's device), and waiting for natural token expiration could mean hours or days of continued unauthorized access — unacceptable during active containment. D is wrong because disabling external forwarding targets a different attack vector. Retaining the malicious consent grant specifically so it can be "examined later" leaves the threat active and defeats the purpose of containment entirely. Your study tip: on OAuth incident questions, always ask "what did the password change actually revoke?" If tokens were issued before the change, assume they're still valid until explicitly revoked.

Question 7

An organization configured the same local administrator password on 600 Windows endpoints. An attacker compromises one endpoint and extracts that password. No evidence yet shows compromise of the other endpoints, but the shared credential permits administrative access to all of them.

Which containment strategy most appropriately reflects the credential's exposure scope?

  1. Isolate the compromised endpoint and change the local administrator password only on that endpoint, since no others are confirmed compromised and a broader reset would cause unnecessary disruption.
  2. Leave the endpoint connected, disable remote desktop across the entire fleet, and rotate the shared password only after forensic analysis of the compromised endpoint is complete.
  3. Isolate the compromised endpoint and rotate the local administrator credential across all endpoints, assigning unique passwords to each system to eliminate the shared-secret exposure. (correct answer)
  4. Reset the affected user's domain account password and monitor all remaining endpoints for observable use of the shared local administrator account before taking further action.
Explanation: When a shared credential is compromised, the exposure scope isn't limited to the single endpoint where the attacker extracted it — it extends to every system that accepts that credential. This is the core concept being tested: lateral movement risk from shared secrets. Your containment strategy must match the actual attack surface, not just the confirmed damage. Option C correctly reflects this principle. Isolating the compromised endpoint stops immediate attacker access from that machine, while rotating the local administrator password across all 600 endpoints — and assigning unique passwords to each — eliminates the shared-secret vulnerability entirely. The absence of confirmed compromise on other systems is irrelevant; the attacker already has the keys to all of them. Option A is the most tempting trap. It feels proportional — only one endpoint is confirmed compromised, so why disrupt 599 others? But this reasoning ignores that the credential itself is the exposure. Changing the password on only one endpoint while 599 systems still share the extracted password leaves the entire fleet vulnerable. Option B delays the critical password rotation behind forensic analysis, during which time the attacker retains valid administrative access to every endpoint in the organization. Disabling RDP alone doesn't revoke the credential — attackers have other lateral movement techniques. Option D addresses the wrong account entirely. The threat here is the local administrator account, not a domain user account. Resetting a domain password does nothing to contain a compromised local credential. For exam questions involving credential compromise, always ask yourself: what is the true blast radius of this secret? That scope defines your containment boundary, not just confirmed victim systems.

Question 8

An analyst discovers that an administrator entered domain-admin credentials into a server later confirmed to have credential-dumping malware. The server is still online because it supports a business-critical process. A clean privileged-access workstation is available, and the process can operate under temporary network restrictions.

Which action best addresses both containment needs?

  1. Reset the domain-admin password from the compromised server, then restrict the server to its required business destinations.
  2. Restrict the server's communications to required services and response tools, then reset the exposed account from the clean privileged workstation. (correct answer)
  3. Keep the server fully connected, reset the account from the clean workstation, and monitor whether the replacement password is used.
  4. Disable the business process, power off the server, and postpone the account reset until a complete forensic image is reviewed.
Explanation: When handling a compromised system that must stay online, you need to think in two parallel tracks: stop the bleeding on the network and perform privileged actions from a trusted environment. The order and location of those actions matter enormously. Option B is correct because it sequences both controls properly. First, restricting the server's communications limits what an attacker can do with any stolen credentials right now — they can't reach other systems or exfiltrate data freely. Then, resetting the exposed domain-admin account from the clean privileged-access workstation ensures the reset credentials themselves aren't immediately re-harvested by the malware still running on the compromised server. You've contained the threat at the network layer and invalidated the stolen credential without introducing new ones into a hostile environment. Option A fails on a critical point: resetting the domain-admin password from the compromised server means typing new credentials into a machine that has credential-dumping malware. You'd be handing the attacker a fresh set of keys while thinking you changed the locks. The network restriction part is valid, but the execution location is the fatal flaw. Option C ignores the network containment step entirely, leaving the server fully connected. Monitoring whether the new password is used is a detective control — useful, but it doesn't prevent lateral movement before detection occurs. Option D over-corrects. Powering off a business-critical server and delaying the account reset prioritizes forensics over active threat containment, leaving a known compromised credential valid and unaddressed. Your study tip: on incident response questions, always ask where a privileged action is performed, not just what the action is. A clean workstation exists precisely so you never trust a compromised host with sensitive credentials.

Question 9

Malware recovered from an application server contains the current password for a service account. The account authenticates three critical applications to a database, and abruptly disabling it would interrupt customer transactions. Administrators can update the applications' secret stores within minutes.

Which action best contains the credential exposure while minimizing avoidable operational impact?

  1. Disable the service account immediately and restore each application after the malware has been completely eradicated.
  2. Remove interactive sign-in rights from the service account but retain its current password until the next maintenance period.
  3. Rotate the service-account password, update all authorized secret stores in a coordinated change, and terminate existing account sessions. (correct answer)
  4. Create a second service account for new transactions while allowing current applications to retain the exposed password temporarily.
Explanation: When a credential is confirmed exposed, your goal is to balance two competing pressures: stopping the attacker's access and preserving business continuity. The right move neutralizes the threat immediately without creating unnecessary downtime — and that's exactly the lens you should apply here. Rotating the password and simultaneously updating all dependent secret stores (C) achieves both goals at once. The exposed credential becomes worthless the moment it changes, cutting off any attacker leveraging it. Because the scenario tells you administrators can update secret stores within minutes, a coordinated rotation causes minimal disruption. Terminating existing sessions closes any active connections that authenticated with the old, compromised password — a critical step often overlooked. Choice A is operationally reckless. Disabling the account immediately breaks all three applications right now, harming customers, when a less disruptive path exists. Waiting for "complete eradication" before restoring service also creates extended downtime with no security advantage over a password rotation. Choice B is dangerously passive. Removing interactive sign-in rights doesn't address the actual threat: the password itself is what the malware exposed. Attackers can still use that password programmatically to authenticate without interactive login. Deferring action until a maintenance window gives attackers a free runway. Choice D compounds the problem. It leaves the exposed credential active and in use, meaning the attacker's stolen password remains valid. Creating a parallel account doesn't contain the breach — it just adds complexity while the vulnerability persists. Study tip: On incident-response questions, watch for answers that trade a definite security fix for an uncertain convenience. If the scenario tells you disruption can be avoided with a coordinated action, that's your signal — choose containment with continuity, not instead of it.

Question 10

An employee's off-site laptop is communicating with a suspected command-and-control domain. The laptop is connected through a home network and is not using the corporate VPN. The endpoint platform can place it in isolation mode while retaining communication with the platform's management service.

Which containment action is most effective under these conditions?

  1. Disable the employee's switch port at the office and revoke the laptop's corporate VPN certificate at the next maintenance window.
  2. Use endpoint isolation immediately, retain the management channel, and separately invalidate any credentials exposed on the laptop. (correct answer)
  3. Block the domain at the corporate perimeter and instruct the employee to avoid connecting to the corporate VPN.
  4. Ask the employee to power off the home router and leave the laptop running until an investigator can retrieve it.
Explanation: When an endpoint is actively communicating with a command-and-control domain, you're dealing with a live incident that demands immediate, targeted containment — not a scheduled fix or a workaround that shifts the problem elsewhere. The key principle here is isolate the threat, preserve visibility, and address credential exposure — all without losing control of the asset. Answer B achieves exactly this. Endpoint isolation cuts off the malicious C2 communication immediately, while retaining the management channel keeps the security team in control of the device — they can push commands, collect forensic data, and monitor behavior remotely. Separately invalidating exposed credentials closes the door on lateral movement even if the attacker already harvested them. Answer A fails on two counts: the laptop isn't at the office, so disabling a switch port does nothing to the active threat, and waiting until a "maintenance window" to revoke certificates is dangerously slow during a live compromise. Answer C only blocks the domain at the corporate perimeter, which is useless since the laptop is operating outside the corporate network entirely — it never touches that perimeter. Telling the employee to avoid the VPN also eliminates a future recovery path. Answer D is tempting because it sounds cautious, but powering off the home router severs your management channel and may destroy volatile memory evidence. Leaving the laptop "running but disconnected" means no containment and no visibility — the worst of both worlds. Your study tip: on incident response questions, always trace the actual network path of the affected device. Perimeter controls only help if the device is behind that perimeter.