ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
While reviewing SIEM dashboards, you notice your cloud-hosted API server generated a critical alert from the network IDS indicating data exfiltration over an unusual port. Following a formally documented incident response process, what action should you take immediately after the IDS alert is received?
Disable the triggering IDS rule to stop additional alerts until further notice.
Alert customers and the media about a confirmed breach to maintain transparency and comply with disclosure requirements.
Correlate the IDS event with host and application logs to verify the alert and assess the scope of the suspected incident.
Immediately wipe and redeploy the affected server from a known-good image to eradicate the potential compromise.
A well-structured incident response process begins with detection and analysis. When an IDS raises an alert, the next step is to validate that the alert represents a genuine security incident and determine its scope and potential impact. This involves correlating the IDS event with additional log sources, confirming indicators of compromise, and assessing which systems or data may be affected. Jumping directly to containment or public notification without confirmation can cause unnecessary disruption or reputational harm, while disabling the alert silences the symptom rather than addressing the problem. Therefore, the correct immediate action is to analyze and confirm the alert before proceeding to containment or escalation.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is an IDS and how does it work?
Open an interactive chat with Bash
Why is log correlation important in incident response?
Open an interactive chat with Bash
What are the key steps in a formal incident response process?
Open an interactive chat with Bash
What is an IDS and how does it work?
Open an interactive chat with Bash
Why is correlating IDS events with logs important?
Open an interactive chat with Bash
What is a formally documented incident response process?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)