Question

During triage in Google SecOps, an analyst confirms that a production database server is beaconing to a known C2 domain and has an active interactive session from an external IP. The SOAR playbook offers an automated action to immediately isolate the host from the network. However, the incident response lead is simultaneously trying to capture the attacker's tooling and lateral movement path for attribution. The host runs a revenue-critical service with no failover. What is the MOST appropriate immediate containment decision?

Accepted Answer

Apply targeted containment that blocks only the C2 domain and the external session's source IP at the firewall while preserving internal connectivity and live telemetry collection

Answer

Trigger the automated full network isolation immediately to stop the C2 channel, accepting the service outage and loss of live attacker activity

Answer

Take no containment action and continue monitoring until the IR lead has fully mapped the attacker's lateral movement to avoid disrupting evidence collection

Answer

Power off the compromised server through the cloud console to guarantee the attacker loses access with the least operational effort