CSA (312-39) SOC Simulation Lab

Welcome to this endpoint-focused Incident Response lab. Today, you'll learn how to categorize mitigation strategies correctly when deploying organizational policies to stop an active lateral movement campaign.

Scenario Context

You are David Reynolds, a SOC Analyst at MedCare Health. Over the last 15 minutes, your SIEM has generated critical alerts for massive internal brute-force activity. A compromised service account is attempting to authenticate across hundreds of nursing station terminals (endpoints) using common password lists.

To quickly mitigate the attack surface while the IR team hunts for patient zero, you contact the IT Infrastructure team to force an immediate Active Directory Group Policy Object (GPO) update. You instruct them to set a strict Account Lockout Policy across all end-user workstations.

Security Environment

You review the SIEM (Microsoft Sentinel) dashboard to verify the attack signature, then confirm the remediation actions applied via AD configuration logs.

[SIEM ALERT - Microsoft Sentinel] Title: High-Volume Failed Logons (T1110.001 - Password Guessing) EventID: 4625 (Audit Failure) TargetUserName: local_admin WorkstationName: WKS-NURSING-012, WKS-NURSING-013, WKS-NURSING-014... Count: 4,500 attempts in 3 minutes across 150 endpoints [REMEDIATION ACTION DISPATCHED] Type: GPO Push (Update) Path: Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Account Lockout Policy Setting Modified: "Account lockout threshold" = 5 invalid logon attempts Status: Successfully applied to 100% of target OU (endpoints)

Question

David Reynolds, a SOC analyst at a healthcare organization, is investigating a series of suspicious login attempts flagged by the SIEM (Security Information and Event Management) system. To mitigate the risk of brute-force attacks on the target end points, he collaborates with the IT team to implement an automatic account lockout policy. Within the SOC's eradication strategy, which category of measures does this action align with?

SOC Hint: Pay close attention to *where* the policy is actually applied and enforced. An account lockout policy modifies the local security configuration of the endpoint's operating system.

Expert Insight & Mentorship

What is happening: The organization is under an active brute-force or credential stuffing attack. The SOC analyst acts quickly to deploy a configuration change across the enterprise fleet. By changing the GPO, every Windows endpoint updates its Local Security Authority (LSA) subsystem to lock out any account after 5 failed attempts, effectively crippling the brute-force script.

Why Option A is Correct

Host Security Measures involve hardening or remediating the actual endpoint (the "host"). Because the Account Lockout Policy modifies the OS-level security configuration of the target endpoints (preventing them from accepting further bad authentication attempts), it is classified as a host-based eradication/mitigation strategy.

Why the Other Options are Wrong

B. Network Security Measures: If David had asked the network team to block the attacker's IP address at the perimeter firewall or switch, *that* would be a network security measure.
C. Authentication and Authorization Measures: This is an attractive distractor. While lockout policies *affect* authentication, incident response frameworks typically divide eradication into Host, Network, and Application domains. Hardening the OS is a Host measure.
D. Physical Security Measures: These are real-world physical controls (CCTV, mantraps), not digital domain configurations.

Real-world SOC Application

In a real incident, you will often hunt through Microsoft Sentinel or Splunk looking for spikes in Windows Event ID 4625 (Audit Failure). If an attacker is performing SMB lateral movement (trying to guess local admin passwords to pivot between machines), enforcing a strict host lockout policy buys the IR team time. Without it, the attacker's automated script will guess thousands of passwords a minute until it hits the correct one.

MINI LESSON: The Eradication Taxonomy

When planning Eradication or Containment in the NIST IR Lifecycle, SOCs categorize their actions so teams don't overlap:

Host-Based Measures: Actions taken directly on the OS. EDR isolation, updating GPOs, registry edits, disabling local accounts, or patching the OS.
Network-Based Measures: Actions taken on transit devices. Null routing, ACL updates on firewalls, DNS sinkholing, or VLAN isolation.
Application-Based Measures: Actions taken on the software logic. WAF rule updates, rolling application API keys, or patching web server code.

SOC Pro-Tip: A robust response strategy always utilizes a combination of Host and Network measures. Blocking the IP at the firewall (Network) while simultaneously enforcing lockout policies on the endpoints (Host) ensures Defense in Depth during a crisis.

Mastered this concept? Keep honing your SOC skills.

Explore more CSA simulations