Scoping a confirmed VPN intrusion: risk identification before containment

350-201 By islever Editorial Last updated

Apply the incident response workflow Determine the next action based on user behavior alerts

Short answer

C Determine which systems and services the attacker can reach using the stolen VPN credentials and the installed remote access tool before choosing a containment action.

Question

A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote
access tool on a user's laptop while traveling. The attacker has the user's credentials and is attempting to connect to the network.
What is the next step in handling the incident?
  1. Block the source IP from the firewall
  2. Perform an antivirus scan on the laptop
  3. Identify systems or services at risk Correct Answer
  4. Identify lateral movement

Key Takeaways

It tests whether you can distinguish durable scoping from a token containment move; the trap is assuming that blocking the source IP stops an attacker who already owns valid credentials.

This 350-201 incident-response question asks the next step after a SIEM alert confirms a remote access tool on a traveler's laptop. The correct action is C, identifying the systems and services at risk, because the attacker holds valid credentials and an IP block would not contain the compromise.

Common mistake: A. Block the source IP from the firewall — plausible as containment, but useless against an attacker with legitimate credentials who can simply reconnect from any other address.

Expert Analysis

Where the boundary sits: containment vs. scoping. This question tests the seam between the NIST incident-response lifecycle's containment step and the scoping/analysis step. Once the team has validated the alert, the immediate question is not "how do we stop this packet" but "how big is this compromise." The scenario hands you three facts: the endpoint is already compromised (a remote access tool is installed), the attacker already holds valid credentials, and the VPN attempt is merely the visible symptom.

Why A fails here. Blocking the source IP at the firewall is the reflex containment action, but it is near-valueless in this specific case. The attacker possesses legitimate credentials, so the very next connection can come from any other IP — a coffee-shop hotspot, a residential proxy, or a second compromised device. One commenter argues that "the attack is real and live, containment is the top priority," and another notes the team already knows which systems are at risk so blocking is the logical move. That reasoning would hold if the only unknown were the attacker's network address. It does not hold when identity, not IP, is the compromised control; the durable containment action here would be disabling or resetting the account and isolating the laptop, and neither appears as an option. A is therefore a weak, non-durable containment gesture dressed up as the answer.

Why C is correct. With the alert confirmed as a true positive, the incident-response workflow moves to determining scope and impact: which systems, data stores, and services the attacker can reach using the stolen credentials and the installed remote access tool. That scope assessment drives every subsequent decision — which accounts to reset, which endpoints to isolate, and which data to treat as exfiltrated. Correct answer: C.

Why B and D are premature. An antivirus scan is an investigation tactic with well-known blind spots against custom remote access tooling and does not advance the response. Lateral movement (D) can only be identified after you know which segments and services are reachable — so it is a consequence of C, not a substitute for it.

Official Reference

https://csrc.nist.gov/pubs/sp/800/61/r2/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

Read each option and ask which phase of the incident-response lifecycle it belongs to, then check whether that phase's prerequisites are already satisfied. When a scenario confirms that credentials or identity are compromised, treat IP-based containment options as distractors, since the attacker controls the address. Pick the option that answers "what is the blast radius" before any option that answers "how do I drop this one connection."

Frequently Asked Questions

Why is blocking the source IP wrong when the attack is still in progress?

The attacker already has valid credentials, so the next VPN session can originate from any other IP address or proxy. An IP block delays one connection but leaves the credential and the installed remote access tool intact, so scope assessment must come first.

What should happen after identifying the systems and services at risk?

Once scope is known, the team resets or disables the compromised account, isolates the laptop, removes the remote access tool, then moves through eradication, recovery, and post-incident review, watching for lateral movement and data loss.

Does an antivirus scan have any role in this incident?

Yes, but later. Signature-based scanning often misses custom or living-off-the-land remote access tooling, so it should support endpoint forensics after scope is established rather than serve as the immediate next step.

More 350-201 FAQ →

Community Votes

C
75%
A
19%
D
6%

75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. CiscoTester 👍 5
    You have already identified a few systems at risk, not C. Somehow you know there is an attempt to connect using VPN, blocking seems logical. answer :A
  2. ak_technonet 👍 2
    Once the team validated true positive alert, it should be identify the system before blocking source ip address in FW. So the correct answer is C
  3. DrVoIP 👍 1
    The next step in handling the incident where the attacker has installed a remote access tool on a user's laptop while traveling and is attempting to connect to the network is: C. Identify systems or services at risk. After validating the alert, the incident response team needs to determine the scope of the attack, which systems or services are at risk, and the potential impact of the attack. The next step would be to identify which other systems or services may be at risk of compromise or attack and assess the potential impact on the organization. A (Block the source IP from the firewall) may be a valid action, but it should be taken after identifying the systems or services at risk and determining the impact of the attack. B (Perform an antivirus scan on the laptop) and D (Identify lateral movement) may also be important steps in responding to the incident, but they should be taken after identifying the systems or services at risk and determining the impact of the attack. - ChatGPT
  4. Luismi 👍 1 Answered C
    If Cisco wanted a clear containment response, it would have listed something like “disable the compromised account” or “isolate the endpoint.” Those would be far better options than blocking an IP address that might change. The fact that these are not among the options reinforces the idea that the goal is to determine the scope → C
  5. czarul79 👍 1 Answered A
    A. Block the source IP from the firewall Why? This is part of the containment phase of the NIST incident response lifecycle. At this point: The attack is real and live. Containment is the top priority to prevent further harm. Blocking the source IP is an immediate action to stop access while further analysis is underway.
Show 3 more comments
  1. jaciro11 👍 1
    You block the IP and what? The attacker can connect through another IP. In no one part the mentioned they have already identified a few systems at risk, that's the next task. so answer is C.
  2. TOLU1985 👍 1 Answered C
    Identify systems or services at risk is correct here.
  3. Medjai89 👍 1
    This is contain phase. So it is A!!!

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

The NIST Incident Response Step the Team Skipped: Containment

S-grade

Server Hardening Recommendations for Production Deployment

S-grade

← Back to 350-201 Study Guide