Incident Response and Network Investigation
This domain tests incident response through a network lens: scoping, containment, evidence preservation, and coordination. Expect questions on IR phases, containment choices, and the order of volatile evidence collection.
Core rules
Use a recognized lifecycle-preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Network containment options include ACL blocks, firewall rules, DNS sinkholes, VLAN isolation, and disabling switch ports. Choose based on blast radius, business impact, and whether the adversary can detect and adapt. Preserve evidence before containment when feasible: capture live connections, ARP and routing tables, firewall state, and logs.
Scope by identifying all hosts communicating with known infrastructure, then pivot on user accounts, certificates, and file hashes. Build a timeline in UTC. Maintain a decision log: who authorized isolation, when, and why. Eradication should remove persistence, not just block one IOC. Recovery requires monitoring for recurrence.
Worked example
Ransomware is spreading on a flat VLAN. The team sees SMB traffic from one host to many others. Immediate switch-port isolation of the source limits spread, but first capture the connection table and preserve SMB logs. Blocking only the ransomware’s C2 IP is insufficient because encryption is lateral. Reasoning: containment must target the transmission path, while evidence collection targets attribution and scope.
Traps
Powering off a host before memory capture; blocking an IOC and declaring closure; isolating without preserving logs; and failing to check whether the adversary uses the same credentials elsewhere. Also avoid containment that destroys the only copy of evidence.