350-201 — frequently asked questions

The attacker already has valid credentials, so the next VPN session can originate from any other IP address or proxy. An IP block delays one connection but leaves the credential and the installed remote access tool intact, so scope assessment must come first.

Once scope is known, the team resets or disables the compromised account, isolates the laptop, removes the remote access tool, then moves through eradication, recovery, and post-incident review, watching for lateral movement and data loss.

Yes, but later. Signature-based scanning often misses custom or living-off-the-land remote access tooling, so it should support endpoint forensics after scope is established rather than serve as the immediate next step.

Containment limits damage and stops the incident from spreading, such as isolating hosts or blocking C2 traffic. Removing the malware is eradication, a later sub-step that must not begin until containment is in place.

It is not a formal phase. Hardening and gap remediation arise from post-incident activity (lessons learned) and ongoing vulnerability management, so it cannot be the 'missed step' in a NIST-based question.

Network isolation or quarantine, disabling the host's network adapter, applying firewall rules to block command-and-control domains, and snapshotting the host for forensics before eradication.

It is primarily relevant to Windows Domain Controllers and Active Directory environments. For general server hardening across diverse platforms, broader controls like firmware passwords are more universally applicable.

Staging allows for testing and validation without exposing potential vulnerabilities to external threats. Once hardened and verified, the server can be moved to its final production environment.