Fourteen Beacons and a Deadline at 07:00
At 02:14, network monitoring detects 14 Windows workstations on a base NIPRNet enclave beaconing to the same external IP address every 30 seconds. The endpoint tool flags a scheduled task that launches an encoded PowerShell command. The local helpdesk wants to reimage all 14 machines before the start of duty, arguing that the unit cannot operate without them. The system owner says the machines contain no sensitive data and that logs are retained for only seven days. One user connected a personally owned laptop to the network through an open Ethernet port the previous afternoon. The cyber squadron has captured a memory image from one host but has not isolated the others. The commander asks the AFOSI agent to 'clean this up quickly' and wants a briefing at 07:00.
1. Should the agent support immediate reimaging, or require preservation first? What sequence should be recommended?
Read the worked answer
The agent should tell the commander that rapid reimaging may destroy the evidence needed to find the initial access and any data theft. The correct sequence is contain, preserve, then remediate. Isolate the 14 hosts from the network at the switch or endpoint firewall, but do not power them off; memory and volatile artifacts may be lost. Capture memory, running processes, scheduled tasks, PowerShell history, local logs, and network flow, DNS, and proxy records before reimaging. Image at least one full host and preserve the already captured memory image; coordinate with the cyber squadron and system owner so remediation does not begin until evidence is secured. The personally owned laptop should be located and isolated, and its connection should be documented; do not examine it without authority. The 07:00 briefing should state what is known, what is preserved, what business-continuity options exist, and a realistic timeline. Reimaging can proceed host by host after capture, with a clean image and changed credentials. The agent should also check whether the beaconing IP is internal or external and whether any domain-admin accounts were used.
2. What legal authority issues arise for monitoring the government hosts and for seizing the personally owned laptop?
Read the worked answer
Legal authority depends on who owns the system and what notice users received. For government systems, agency monitoring notices and user agreements may authorize network-defense monitoring, but that does not automatically authorize searching a person's private files or a personally owned device. The agent should consult SJA and the prosecutor before seizing the personal laptop; consent from the owner, a warrant, or a recognized exception may be needed. The user's connection to an open Ethernet port may violate policy, but a policy violation is not consent to search. Preserve the laptop, document the port and switch logs, and ask for consent in writing if appropriate; do not threaten consequences to obtain it. For the 14 government hosts, preserve under the system owner's authority while coordinating with AFOSI cyber personnel. Keep a decision log showing who authorized each step. If classified information is later found, stop and follow classified-incident procedures. The agent should avoid broader monitoring of user content than necessary and should minimize unrelated personal data. The report should separate network-defense actions from investigative actions.
3. How should the agent scope the intrusion, handle the seven-day log limit, and notify leadership?
Read the worked answer
Scope should be established from the beaconing IP, DNS requests, proxy logs, scheduled-task creation, and authentication logs. The agent should determine whether the 14 hosts are the full set, whether lateral movement reached servers or domain controllers, and whether data left the enclave. The seven-day log retention is a serious constraint; preserve what exists immediately and ask the cyber squadron to check centralized logging, SIEM, and backups. Interview the user who connected the personal laptop and the helpdesk staff factually, without accusing them. Notify the commander, system owner, and AFOSI leadership; if the intrusion appears criminal, coordinate with the U.S. Attorney's Office and possibly the FBI, and if it involves a foreign actor, the CI element. Do not send a base-wide email with indicators. The final report should include a timeline, affected systems, evidence preserved, containment actions, and recommendations. Remediation should include credential resets, isolation, patching, and user awareness, but only after evidence capture. The agent should track hours and decisions because the commander will ask why the network was not simply wiped.