A compromised public web server has been isolated and the attacker's addresses blocked. The business needs the service back within days, but a clean rebuild and full investigation will take weeks. What is the appropriate longer-term containment step?
Select an answer to reveal the explanation.
Short Explanation
Short-term containment is the tourniquet; long-term containment is the splint that lets you walk while the bone heals. You keep the business running on something temporary and watched closely, and you build the clean version in parallel. Don't confuse a blocked address with a cured patient.
Full Explanation
Containment is often staged. Short-term containment acts quickly to stop the immediate damage, for example isolating a host and blocking known attacker infrastructure. Longer-term containment applies temporary measures that let essential services operate safely while eradication and a clean rebuild are prepared: a patched and hardened interim system, tighter access controls and enhanced monitoring for signs of attacker return. This balances business needs against the risk that the attacker retains other footholds. Treating address blocks as eradication is a category error; attackers change infrastructure easily, and persistence mechanisms, compromised credentials and the original vulnerability would remain. Returning the original server unchanged reintroduces a system whose integrity is unknown, with the same weakness that allowed compromise and possibly hidden backdoors. Keeping the service offline until the investigation finishes ignores the business requirement entirely; that choice is not the security team's to impose, and an interim system can reduce risk to an acceptable level for the business owner to accept. Exam caveat: the interim arrangement should be approved by the business owner with residual risk documented, and it is temporary by design. Operational check: confirm the interim system's hardening, its monitoring coverage and a dated plan for cutover to the rebuilt system.