A retailer has confirmed a beacon on a register that is still attached to the store LAN, and the incident plan says to isolate a confirmed host before imaging it. What is the next handling step?
Select an answer to reveal the explanation.
Short Explanation
Once you know the fire is in one room, you close that door before you remodel. The beacon is confirmed and the plan says to isolate the register before imaging, so containment by isolation comes next. Reimaging first, a press release, or a new score leaves the host exposed or destroys live state.
Full Explanation
The beacon is already confirmed and the register is still on the store LAN, and the plan orders isolation before imaging. Isolate the confirmed register, then preserve evidence in the order the plan already sets, is containment followed by the preservation step the plan names. Reimage the register at once, skipping isolation and discarding live memory and connections, both leaves the host online until the wipe and destroys the live state investigators still need. Publish a press release about the beacon before the register is isolated or preserved, is a communications act that does not contain the host. Rescore the beacon with a fresh CVSS vector and leave the register on the store LAN, changes a severity description and leaves the beacon on the network. Exam caveat: isolation is the containment part of containment, eradication, and recovery. NIST SP 800-61 Rev. 3 maps that phase onto CSF 2.0 Functions, and memory collected under NIST SP 800-86 is gone after power-off, so a rebuild is not the preservation step. Operational check: confirm the register is actually off the store LAN, then capture evidence in the plan's order before any rebuild.