Home ExamRange Practice Tests

CSA (312-39) SOC Simulation Lab

Master the operational execution of the Incident Handling and Response (IH&R) framework. In this scenario, you will evaluate a critical structural network change implemented by the SOC during an active ransomware outbreak and map it to the correct phase of the NIST/EC-Council IR lifecycle.

Scenario Context

It is 10:30 AM. A Tier 1 analyst (Jennifer) escalates a high-confidence alert showing rapid file modification anomalies across file shares in the Finance department. Triage confirms the presence of LockBit ransomware.

SOC Lead (Sarah) immediately initiates the Ransomware Playbook. Her first technical directive to the Network Operations Center (NOC) is to implement an emergency ACL/VLAN isolation for the entire Finance subnet, severing its connection from the core corporate network.

Security Environment

Splunk & Firewall Action Logs:

# 10:25:01 AM - SIEM High Severity Alert index=windows EventCode=4663 Object_Name="*.lockbit" Access_Mask=0x20000 ALERT: High volume of file extensions changed to .lockbit on FIN-FS-01. # 10:30:45 AM - Emergency Action Initiated [SOC_LEAD_SARAH] Executing Playbook: Playbook_Ransomware_v2 [SOC_LEAD_SARAH] Requesting immediate isolation of VLAN 105 (Finance). # 10:32:11 AM - Palo Alto Panorama Log admin="sysadmin_noc" action="commit" description="Emergency isolation of FIN_VLAN_105 per SOC IRT" rule_name="DENY_FIN_TO_ANY" action="drop" source_zone="Finance" destination_zone="Any" STATUS: SUCCESS. Finance VLAN is air-gapped from internal routing.

Question

At 10:30 AM, during routine monitoring, SOC's Tier-1 Jennifer detects unusual network traffic and confirms an active LockBit ransomware infection targeting systems in the finance department. She escalates the issue to the SOC lead, Sarah, who activates the Incident Response Team (IRT) and instructs the network team to isolate the finance department's VLAN to prevent further spread across the network. Which phase of the Incident Response process is currently being implemented?
SOC Lead Hint: Look at the immediate goal of Sarah's action. She isn't deleting the malware yet, and she isn't purely collecting logs. She is putting a "tourniquet" on the network to stop the "bleeding" (lateral movement).

Expert Insight

1. What is happening

LockBit is aggressively attempting to move laterally across the network via SMB/WMI to encrypt more shares. By isolating VLAN 105 at the firewall level, Sarah is sacrificing the availability of the Finance department to protect the integrity of the rest of the company. The ransomware is still actively running on the Finance endpoints, but it is now trapped.

2. Why the correct answer is correct

C. Containment

In the IH&R lifecycle, Containment is the phase dedicated to limiting the scope and magnitude of an incident. Its primary goal is to prevent the threat from spreading to unaffected systems. Isolating a VLAN, disabling compromised AD credentials, or using an EDR network-quarantine feature are textbook examples of containment actions.

3. Why other options are wrong

A. Evidence Gathering: While forensic evidence (like memory dumps) should ideally be collected during or immediately after containment, the specific act of severing network traffic is not evidence gathering.

B. Eradication: Eradication involves actively removing the threat (e.g., deleting the malware, wiping the drives, patching the vulnerability). The systems in the Finance VLAN are still infected; eradication hasn't started yet.

D. Notification: Notification involves alerting internal stakeholders, legal counsel, or regulatory bodies. It is a communication step, not a technical mitigation step.

5. MINI LESSON: Short-term vs. Long-term Containment

Senior analysts must distinguish between types of containment:

  • Short-term Containment: Immediate, reactive steps to stop the bleeding. Example: The VLAN isolation seen in this scenario, or pulling the physical network cable.
  • Long-term Containment: Temporary fixes that allow the business to continue operating while Eradication is planned. Example: Implementing strict zero-trust firewall rules, rotating all privileged passwords, and blocking known malicious C2 IPs across the enterprise.

Always ensure that your containment actions do not destroy forensic evidence (e.g., do not reboot the infected host, as it clears RAM).

Ready to level up your Incident Response decision-making?
Explore more CSA simulations at ExamRange