Question

A SOC analyst is investigating a suspected data breach involving a production PostgreSQL database that holds customer records. The DLP system flagged an unusually large outbound transfer, but the destination and content have not yet been confirmed. Before pulling in the DBA team or notifying legal, what should the analyst do FIRST to properly scope this potential data loss from the database vector?

Accepted Answer

Review the database audit logs and query history to identify what data was accessed and by which account

Answer

Immediately shut down the database service to stop any ongoing exfiltration

Answer

Restore the database from the most recent backup to a clean isolated host

Answer

Reset all database user credentials and rotate the service account keys