CSA (312-39) SOC Simulation Lab

Welcome to the SOC. Today, we are managing a live incident. You will learn how to accurately track the stages of the Incident Response (IR) lifecycle during a critical ransomware outbreak.

Scenario Context

At GlobalTech, a multinational corporation, the SOC team detects a suspicious ransomware outbreak affecting multiple endpoints. The L1/L2 team acted quickly, pushing an API call to the EDR platform to logically sever the network connection of the infected hosts, preventing lateral movement.

Now, the Digital Forensics team, led by Ray Martinez, is stepping in. Before anyone touches the power buttons or starts deleting malware files, Ray's team needs to grab volatile data to figure out exactly how the attackers got in and what keys were used.

Security Environment

Review the timeline of operations in the SOAR (Security Orchestration, Automation, and Response) platform ticket:

// SOAR Incident Timeline - INC-2023-8842 [14:02:11] ALERT: Multiple High-Severity EDR detections (Ransomware.CryptoWall.Generic) [14:05:30] ACTION: SOC Analyst executing Host Isolation via EDR on 4 endpoints. [14:05:45] SYSTEM: Host Isolation Successful (Status: CONTAINED). [14:15:00] UPDATE: Transitioning ticket to DFIR team. [14:22:15] ACTION: DFIR script 'Live_Triage_Acquisition.ps1' executed via EDR Live Response. [14:23:40] LOG: Dumping physical memory to memdump.raw... [14:25:10] LOG: Exporting Windows Event Logs (System, Security, Application)... [14:28:00] LOG: Pushing artifacts to secure evidence locker (S3-DFIR-Bucket).

Note: The systems are logically isolated but remain powered on to preserve RAM.

Question

At GlobalTech, a multinational corporation, the SOC team detects a suspicious ransomware outbreak affecting multiple endpoints. After successfully isolating the infected systems from the network, the Digital Forensics team, led by Ray Martinez, begins their investigation. They deploy a forensics workstation to acquire RAM dumps, extract Windows Event Logs, and collect network PCAP files from the compromised hosts. Which phase of the Incident Response lifecycle is currently underway?

Expert Insight: Senior SOC Analyst

What is happening here?
In a real ransomware crisis, inexperienced IT staff often panic and turn off infected machines or immediately run antivirus to delete the malware. This destroys critical volatile memory (RAM) where decryption keys or C2 network connections might be stored. Here, the SOC properly contained the threat (network isolation) and immediately handed it over to DFIR for evidence preservation before eradication occurs.
Why Option D is Correct:
Acquiring RAM dumps, event logs, and PCAPs are definitive actions of the Evidence Gathering and Forensic Analysis phase. In the EC-Council Incident Handling framework, this phase immediately follows Containment and precedes Eradication. It ensures that legal evidence is preserved and the root cause is understood.
Why the Others are Wrong:
C (Containment): The prompt explicitly states the systems were "successfully isolating" the hosts before forensics began. Containment is already complete.
A (Eradication): This phase involves actively removing the threat (deleting the malware, closing vulnerable ports, resetting compromised passwords). We aren't deleting anything yet; we are capturing data.
B (Recovery): This phase involves restoring systems to normal operations (e.g., restoring from backups, re-imaging).

SOC Mini-Lesson: The Order of Volatility (RFC 3227)

When Ray's team performs Evidence Gathering, they cannot collect data randomly. As a SOC analyst, you must enforce the Order of Volatility. Always collect data starting from what disappears fastest to what is most permanent:

  1. Registers & Cache: CPU data (extremely difficult to capture, rarely done in standard IR).
  2. Routing Tables, ARP Cache, Process Tables, RAM: Collected via live memory dumps. Lost instantly if the machine is powered off.
  3. Temporary File Systems: Swap files, paging files (pagefile.sys).
  4. Disk or Storage Media: The actual hard drive (captured via forensic imaging).
  5. Remote Logging / Network Topology: SIEM logs, firewall configs.
  6. Archival Media: Backups.

Master the complete Incident Response lifecycle.

Explore more CSA simulations →