ExamRange – CSA 312-39 Simulation

Master the NIST Incident Response lifecycle. Learn how to immediately halt lateral movement during an active breach scenario.

Scenario Context

A high-severity alert just triggered in the SOC. A financial controller's workstation (WS-FIN-042) has been compromised. The attacker has bypassed local AV and is currently using compromised credentials to scan and connect to internal file shares and domain controllers.

As the primary incident handler, you have confirmed the threat is real and active. The immediate priority is stopping the bleeding before the attacker accesses sensitive financial data or deploys ransomware across the network.

Security Environment

Review the SIEM and EDR telemetry. The attacker is actively pivoting.

[Splunk Enterprise] index=windows EventCode=4624 Logon_Type=3 Source_Network_Address="10.4.12.88"

TIME: 2023-10-27T14:22:01Z HOST: DC-PRIMARY-01 MSG: An account was successfully logged on. ACCOUNT_NAME: s.admin SOURCE_IP: 10.4.12.88 (WS-FIN-042) LOGON_PROCESS: NtLmSsp

[CrowdStrike Falcon] Alert ID: 88492-CS

DETECTED: Suspicious PowerShell Execution (Invoke-WmiMethod) ENDPOINT: WS-FIN-042 STATUS: Not Blocked - Detection Only Mode TARGET: 10.4.10.5 (FS-FINANCE-SHARE)

Expert Insight

1. What is happening

The SOC has detected active lateral movement originating from WS-FIN-042. The attacker is using WMI and NTLM authentications to move from the initially compromised host to Domain Controllers and File Shares. The incident is currently unfolding in real-time.

2. Why the correct answer is correct (A)

Containment is the phase of the NIST Incident Response lifecycle strictly focused on limiting the scope and extent of an incident. In this scenario, containing the threat means isolating WS-FIN-042 from the network (e.g., using CrowdStrike's "Network Contain" feature) to physically and logically prevent the attacker from reaching FS-FINANCE-SHARE or the Domain Controller. You stop the bleeding first.

3. Why the other options are wrong

B. Data Collection: This is a forensic action. While you collect memory/disk images, it does nothing to stop the active spread of the attacker.
C. Eradication: This is the *removal* of the threat (deleting the malware, wiping the machine). You cannot eradicate a threat while it is still actively spreading and uncontained.
D. Identification: This phase is already complete. The SIEM and EDR alerts successfully identified the incident.

4. Real-world SOC application

In a real SOC, hesitation during the Containment phase leads to full domain compromise. Junior analysts often spend too much time trying to figure out *how* the attacker got in (Identification/Forensics) while the attacker is actively encrypting servers. As a Senior Analyst, my rule is: If you confirm a host is compromised and beaconing/pivoting, **isolate it immediately**. You can always investigate an isolated machine, but you cannot un-encrypt a file share.

MINI LESSON: NIST IR Lifecycle (PICERL)

The NIST SP 800-61r2 framework defines the IR lifecycle as Preparation, Detection & Analysis (Identification), Containment, Eradication, & Recovery, and Post-Incident Activity.

Containment is often split into two sub-phases:

Short-term Containment: Immediate isolation (e.g., pulling the network cable, EDR host isolation, disabling the switch port).
Long-term Containment: Temporary fixes allowing production to continue while building clean systems (e.g., routing traffic through a sinkhole or applying specific ACLs).

CSA (312-39) SOC Simulation Lab