WGU C845 Task 2: Evaluating Incident Response Operations & Defending Network Security | Latest 2026 Update with complete solutions.

v RRRR




WGU C845 Task 2:
WGU C845 Task 2: Evaluating Incident Response Operations & Defending


Network Security | Latest 2026 Update with complete solutions.




Prose1 Stuvia
v




THIS DOCUMENT CONTAINS:

 WGU C845 Task 2



 Evaluating Incident Response Operations



 Defending Network Security



 Latest 2026



 Update with complete solutions

, https://www.stuvia.com/user/Prose1




A. Evaluate the organization's response to v v v v




the security incident.
v v v




A1. Three Actions the Organization Took in Response to the
v v v v v v v v v




Incident.
v




1. Containment: The affected machine (10.1.1.45) was isolated from the network by v v v v v v v v v v




disabling its network port at 10:07.
v v v v v v




2. Eradication & Recovery: The endpoint was restored from a backup at 13:45, and v v v v v v v v v v v v




antivirus (AV) scans were initiated on the HR subnet.
v v v v v v v v v




3. Post-IncidentImprovement: Antivirusdefinitionswere updatedacrossall endpointson the v v v v v v v v v v




following day (06/25 at 08:30).
v v v v v




A2. Evaluation of Effectiveness Using a Recognized
v v v v v v




Framework.
v




Using the NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide) framework, the
v v v v v v v v v v v v v




effectiveness of these actions is evaluated as follows:
v v v v v v v v




• Action 1 (Containment via Port Disable): Partially Effective. According to NIST,
v v v v v v v v v v




containment strategies should be chosen based on the potential for damage and the need
v v v v v v v v v v v v v v




to preserve evidence. Disabling the switch port was a fast and effective way to immediately
v v v v v v v v v v v v v v v




stopongoingdataexfiltration or command-and-control(C2)traffic,aligning with the goal of
v v v v v v v v v v v v v




minimizing immediate impact. However, the IDS log shows lateral movement via SMB from
v v v v v v v v v v v v v




the infected host (10.1.1.45 to 10.1.2.10) at 10:45, which occurred after the initial
v v v v v v v v v v v v v




containment at 10:07. This indicates the containment was either not fully effective on the
v v v v v v v v v v v v v v




first attempt or that a second, compromised host existed. A more robust containment
v v v v v v v v v v v v v




strategy is needed.
v v v




• Action 2 (Restoration from Backup & Subnet AV Scan): Effective for Recovery, Inadequate
v v v v v v v v v v v v




for Eradication. NIST emphasizes that eradication must ensure the malicious content is
v v v v v v v v v v v v




completely removed. Restoring from a clean backup is a valid and effective recovery tactic.
v v v v v v v v v v v v v v




Initiating AV scans on the HR subnet is a good eradication step to find other potential
v v v v v v v v v v v v v v v v




infections. However, the procedure relies on "removing known threats," which may not
v v v v v v v v v v v v




catch polymorphic malware or new variants. The focus on the HR subnet, while logical, may
v v v v v v v v v v v v v v v




have missed the lateral movement to the Finance subnet (10.1.2.10), as shown in the IDS
v v v v v v v v v v v v v v v




log.
v




• Action 3 (Organization-wide AV Update): Effective. This is a clear and effective post-
v v v v v v v v v v v v




incident activity that aligns with the NIST "Post-Incident Activity" phase. By updating
v v v v v v v v v v v v




definitionsacrossallendpoints,theorganization improvesits defensiveposture against a
v v v v v v v v v v v v




recurrence of the same threat, strengthening its preparedness for future incidents.
v v v v v v v v v v v