5.1. Describe Security Threats to the End User, Perform Basic Investigation, and Escalate to the Appropriate Team. 100-140 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A user suspects a security incident and has gathered some initial information, including the time of the incident, the affected system, and any error messages. What should the user do next?

   • AShare the information on social media to warn others
   • BEscalate the incident to the appropriate team following the organization's procedures
   • CWait to see if the issue resolves itself
   • DAttempt to fix the issue by deleting system files
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After running a malware scan, the security software reports a 'trojan' in a downloaded file. What should the user do next?

   • AIgnore the warning because the file was downloaded from a trusted website.
   • BDisable the antivirus to improve system performance.
   • CQuarantine or delete the file as recommended by the software.
   • DOpen the file to confirm it is a false positive.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A user notices that their account was locked out this morning. The system logs show multiple failed login attempts from an unfamiliar IP address at 3:00 AM. What should the user do?

   • ACheck if the IP address is in the company's office range.
   • BAsk the IT help desk to remove the lockout and continue working.
   • CIgnore it because the account was locked and the attempts failed.
   • DChange their password and report the incident to the security team.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A technician receives a report from a user who clicked a link in a suspicious email and entered their username and password on a fake login page. The technician has confirmed the user's account shows unusual login activity. What should the technician do as part of the basic investigation before escalating?

   • ADocument the email header, the URL of the fake page, the time of the incident, and the user's account activity, then escalate to the security team.
   • BAsk the user to change their password and then consider the issue resolved without further action.
   • CSend a warning email to all employees about the phishing attempt, but do not document the specific incident.
   • DImmediately delete the user's email account and create a new one, then report the incident.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A user has accounts on multiple websites and uses the same password for all of them. What is the primary risk of this practice?

   • AIt makes passwords harder to remember
   • BIt violates website terms of service
   • CIf one account is compromised, all accounts using the same password are at risk
   • DIt increases the risk of phishing attacks
   Reveal Solution Discussion Select an answer first