CSA (312-39) SOC Simulation Lab

In this module, you will analyze active incident response telemetry to accurately identify the current operational phase of the NIST Incident Response lifecycle.

Scenario Context

You are a Tier 3 analyst leading a major incident response at a healthcare organization. At 02:00 AM, XDR alerts fired indicating rapid file encryption on a critical Exchange server. Your IRT quickly isolated the host at the hypervisor level.

Subsequent forensic triage revealed the threat actor breached the environment by exploiting CVE-2024-0123. With the bleeding stopped, your team is executing an automated SOAR playbook to ensure the threat cannot re-enter or execute further.

Security Environment

Review the active SOAR playbook execution log below. Note the specific actions being orchestrated across your security tools.

{ "ticket_id": "INC-2026-0491", "status": "In Progress", "playbook_actions": [ { "action": "Isolate_Host_EDR", "target": "EXCH-SRV-01", "status": "Completed" }, { "action": "Apply_Hotfix", "kb": "KB5025941", "target": "EXCH-SRV-01", "status": "Running..." }, { "action": "Update_Mail_Gateway", "rule": "Block_Malicious_Hash", "status": "Completed" } ], "analyst_notes": "Root cause identified as CVE-2024-0123. Eliminating vulnerability footprint prior to restoring services." }

You are a SOC analyst on duty when the team receives an alert about a ransomware incident affecting the organization's email infrastructure. The forensic analysis, conducted by the incident response team (IRT), identifies that the ransomware exploited CVE-2024-0123 in an unpatched mail server. The IRT is now actively deploying emergency patch KB5025941, updating mail filtering rules to block malicious payloads, and implementing additional network segmentation to limit lateral movement. Based on this scenario, which phase of the Incident Response process is the SOC currently executing? A. Recovery B. Containment C. Eradication D. Evidence Gathering and Forensic Analysis

Analyst Hint: While network segmentation is a Containment action, the prompt highlights the deployment of an emergency patch (KB5025941) to fix the exploited CVE. Patching vulnerabilities to remove the root cause of the breach is the hallmark of which phase?

Expert Insight

1. What is Happening (SOC Level)

During a major incident, the lines between phases often blur. Initially, the team isolated the server (Containment). Then, they performed root cause analysis (finding the CVE). Now, the SOC/IRT is fundamentally altering the environment by applying patches and removing the attack vectors so the adversary cannot immediately re-compromise the asset once it is brought back online.

2. Why the Correct Answer is Correct (C: Eradication)

According to standard incident response frameworks (like NIST SP 800-61), Eradication involves eliminating the components of the incident. This specifically includes deleting malware, disabling breached accounts, and mitigating vulnerabilities that were exploited. Deploying the emergency patch (KB5025941) to fix CVE-2024-0123 directly aligns with eliminating the root cause.

3. Why the Other Options are Wrong

Containment (B) is focused purely on stopping the spread (like the network segmentation mentioned), but the act of patching the vulnerability pushes the primary phase into Eradication. Recovery (A) is the next phase, which involves restoring the email server back to normal business operations and monitoring it. Evidence Gathering (D) already occurred when the team successfully identified the CVE in the first place.

🛡️ SOC MINI LESSON: The NIST IR Lifecycle

In the SOC, we follow the NIST SP 800-61 Rev. 2 lifecycle. Note how the middle phases overlap:

1. Preparation: Building playbooks, deploying EDR, tuning the SIEM.
2. Detection & Analysis: The SIEM fires an alert; the analyst determines if it's a true positive.
3. Containment, Eradication, & Recovery:
- Containment: Stop the bleeding (Isolate host, block IPs, disable accounts).
- Eradication: Remove the threat (Delete malware, patch the CVE).
- Recovery: Restore to normal (Reimage machine, restore from backup, resume business).
4. Post-Incident Activity: The "Lessons Learned" meeting. How do we prevent this next time?

Ready to sharpen your defensive thinking further?

Explore more CSA simulations and practice exams →