CISSP Practice Question: An internal host is exfiltrating sensitive data to a known malicious IP…

Correct Answer: A. Isolate the compromised host by blocking its traffic at the firewall level

Explanation (CISSP Manager Logic):

The immediate priority during an active breach is containment to stop data exfiltration and limit the blast radius. Isolating the host provides a rapid response that mitigates further risk to the organization while preserving the system for forensic analysis.

By isolating the host, you:

• Halt the unauthorized transfer of sensitive corporate assets.
• Prevent the compromised system from receiving further instructions from command-and-control servers.
• Maintain the integrity of the evidence for subsequent root cause analysis.

While the other options are relevant, they fall short because:

• B: Encryption protects data in transit but does not prevent a compromised host from sending authorized data to an adversary.
• C: Resetting the system is a recovery step that should only occur after containment and forensic evidence collection are complete.
• D: An IDS provides visibility and alerts but lacks the active response capability required to stop an ongoing exfiltration event.

Think like a manager:

Prioritize containment and risk mitigation during an active incident. Your first responsibility is to "stop the bleeding" and protect digital assets before moving to remediation.