Question

During an active incident, a Google SecOps SOAR playbook is triggered by a case involving a compromised Compute Engine VM showing signs of cryptomining and possible credential theft. Your IR team wants automation to contain the threat, but the incident may require legal follow-up and root cause analysis. Which sequencing of automated playbook actions best balances containment with the need for later forensic investigation?

Accepted Answer

Snapshot the boot and data disks and capture memory/instance metadata, then isolate the VM via firewall rules while leaving it running, before any destructive remediation.

Answer

Immediately delete the VM instance to stop the malicious activity, then create a case note documenting the deletion timestamp.

Answer

Stop (power off) the VM first to halt processes, then rely on Cloud Logging alone to reconstruct events since disk state is already preserved.

Answer

Quarantine the associated service account and rotate keys immediately, taking no action on the VM until an analyst manually reviews it hours later.