A security team detected an above-average amount of inbound tcp/135 connection attempts from unidentified senders. The security team is responding based on their incident response playbook. Which two elements are part of the eradication phase for this incident? (Choose two.)

The eradication phase of incident response focuses on eliminating the root cause of the incident and removing all malicious artifacts from the environment. In the given scenario of excessive inbound connection attempts, the playbook's eradication phase would involve two key actions:
1. Removing any potential compromise: The connection attempts may have succeeded in delivering malware. Using anti-malware software is a fundamental step to scan for and remove any malicious code from affected systems.
2. Eliminating the attack vector: To prevent the identified malicious senders from repeating the attack, their IP addresses should be added to a permanent enterprise block list. This action eradicates the specific threat source from being able to access the network.

B. data and workload isolation: This is a containment strategy, not eradication. Its purpose is to limit the spread and impact of an incident, not to remove the threat itself.
C. centralized user management: This is a foundational security control related to identity and access management, typically part of the preparation or hardening phase, not a direct eradication step for this type of incident.
D. intrusion prevention system: An IPS is primarily a tool for detection and containment. While it blocks attacks, its real-time blocking function is considered containment. The permanent rule implementation is better described by block listing.

1. National Institute of Standards and Technology (NIST) Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide":

Section 3.4.3

Eradication and Recovery (Page 39): States

"In the eradication phase

the incident response team eliminates the cause of the incident. For example

for a malware incident

the team would remove the malware from infected hosts. They would also identify and mitigate all vulnerabilities that were exploited." This directly supports using anti-malware (A) and mitigating the vulnerability of being accessible to attackers by blocking them (E).

2. Cisco

"Incident Response: How to Fight Back" White Paper:

Section: The Incident Response Process

Eradication (Page 4): Describes this phase as when "the IR team works to eliminate the components of the incident... This could include removing malware

deleting accounts used by the attacker

or identifying and mitigating the vulnerabilities that were exploited." This aligns with removing malware (A) and mitigating the threat by blocking the source (E).

3. Carnegie Mellon University

Software Engineering Institute

"Defining the Building Blocks of a Computer Security Incident Response Team (CSIRT)":

Section 2.3

Incident Handling Life Cycle: This document

which outlines foundational CSIRT concepts

describes eradication as the phase for removing the cause and effects of the incident. This includes "removing malicious code" and "implementing blocks to prevent recurrence from the same source

" which correspond directly to options A and E.