Question

A SOC analyst receives an automated alert from the intrusion detection system indicating possible lateral movement on an internal subnet. Before any containment actions are taken, what should the analyst do FIRST?

Accepted Answer

Validate the alert to confirm whether an actual incident has occurred

Answer

Immediately isolate all affected hosts on the subnet to prevent spread

Answer

Escalate the alert to executive management for a containment decision

Answer

Begin eradication by removing suspected malware from the affected hosts