4.4 Mitigation Techniques

Question 1

What containment technique is the strongest possible response to an incident?

Answer 1

Isolating Affected Systems:
removing an affected component from whatever larger environment it is a part of. This can be everything from removing a server from the network after it has been the target of a DoS attack, placing an application in a sandbox virtual machine (VM) outside of the host environments it usually runs on

Question 2

Segmentation-based containment

Answer 2

means of achieving the isolation of a host or group of hosts using network technologies and architecture. Segmentation uses VLANs, routing/subnets, and firewall ACLs to prevent a host or group of hosts from communicating outside the protected segment

Question 3

Enumeration

Answer 3

process of extracting user names, machine names, network resources, shares, and services from a system. Isolating the attacker would only stop their direct two-way communication and control of the affected system