4.4 Post-Incident Mitigation

Question 1

Actions for endpoint mitigation post-incident

Answer 1

Application white/black lists, quarantine un-recognized apps

Question 2

Isolation relative to post-incident mitigation

Answer 2

Systems can be isolated from network during remediation of breach/compromise

Question 3

Define containment relative to mitigation strategy

Answer 3

Containment runs each application in its own sandbox to limit pivoting if the application is compromised

Question 4

Define segmentation as a mitigation strategy

Answer 4

Segmentation is creating protected network segments for sensitive devices so that if the internal network is breached, the sensitive devices are protected

Question 5

Define Security Orchestration, Automation, and Response (SOAR)

Answer 5

A centralized tool allowing the automation of admin tasks, such as disabling a user account

Question 6

Define runbook

Answer 6

A script or description of the steps for a specific task

Question 7

Define playbook

Answer 7

The combination of runbooks into a larger task