CSA (312-39) SOC Simulation Lab
Scenario Context
You are the Incident Commander for a ransomware event at GlobalTech. The L2 analysts previously isolated the infected hosts via CrowdStrike, and the Threat Intelligence team identified the root cause as a vulnerable public-facing server. That server has now been patched and cleaned.
You are now observing the IT Operations team executing the final steps in the playbook to get the Finance department back online before the end of the fiscal quarter.
Security Environment (IR Dashboard)
Review the following system activity logs aggregated in the SOC dashboard:
Question
The SOC team at GlobalTech has just finished patching a critical vulnerability exploited during a ransomware attack. The team is now restoring 2.3TB of encrypted data from their Veeam backup system, rebuilding 23 compromised workstations identified through SIEM logs and re-enabling network access for the finance department after validating the systems are clean.
Which of the following Incident Response phase is this?
Expert Insight
What is happening:
The threat actor's access has been terminated (Eradication) via patching the vulnerability. Now, the organization is dealing with the fallout. Restoring data from Veeam backups, re-imaging compromised endpoints, and removing firewall/EDR isolations to allow the business to function again are classic recovery operations.
Why Recovery (D) is correct:
According to the NIST SP 800-61 Incident Response Lifecycle, the Recovery phase involves restoring systems to normal operation, confirming that the systems are functioning normally, and (if applicable) remediating vulnerabilities to prevent similar incidents. Returning data from backups and lifting network quarantines define this phase.
Why the others are wrong:
- Post-incident Activities (A): This phase occurs after the business is fully recovered. It involves writing the final incident report, conducting a "lessons learned" meeting, and updating security policies or playbooks to handle future attacks better.
- Containment (B): This is the "stop the bleeding" phase. It involves isolating infected hosts, dropping malicious IP traffic at the firewall, or disabling compromised accounts. The prompt states systems are already being re-enabled, meaning containment is over.
- Eradication (C): This involves removing the attacker and the root cause. Deleting malware, changing compromised passwords, and patching the initial vulnerability are eradication steps. The prompt states they "have just finished patching," signaling the end of eradication.
MINI LESSON: The NIST IR Lifecycle in the SOC
A Senior Analyst must clearly understand when one phase ends and another begins, as this dictates who is leading the effort (SOC vs. IT Ops):
- Preparation: Having Veeam backups configured, EDR deployed, and playbooks written before the attack.
- Detection & Analysis: SIEM alerts fire, analysts investigate, and confirm it is a true positive ransomware event.
- Containment: EDR network isolation is triggered. Firewalls drop outbound C2 traffic.
- Eradication: IR team deletes the ransomware payload and patches the vulnerable server.
- Recovery: IT Ops takes the lead to restore backups, rebuild machines, and lift network isolation. (You are here).
- Post-Incident: The CISO hosts a meeting to ask why the vulnerability wasn't patched sooner.