Question

A company recently experienced a security incident in which its domain controllers were the target of a DoS attack.

In which of the following steps should technicians connect domain controllers to the network and begin authenticating users again?

A. Preparation
B. Identification
C. Containment
D. Eradication
E. Recovery
F. Lessons learned

Answer 1

Technicians should connect domain controllers to the network and begin authenticating users again during the Recovery phase of incident response, following the Eradication of the threat.

Step-by-step explanation:

When a company experiences a security incident such as a DoS attack on its domain controllers, there are several steps that need to be followed before the network can resume normal operations. The step where technicians should connect domain controllers to the network and begin authenticating users again is the Recovery phase. During Recovery, systems are restored and security is re-established to ensure the operations can continue securely.

The Recovery phase follows after the Eradication step, where the threat is completely removed from the affected systems. Once security professionals are confident that the threat has been eradicated, Recovery involves tasks such as restoring systems from backups, patching vulnerabilities, and reinforcing security measures. This phase ensures the services are returned to a fully functional state and that the threat is not present.

The final step, Lessons Learned, occurs after Recovery and involves analyzing the incident to improve future responses and prevent similar attacks.