Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During a malware outbreak, the incident response team isolates affected workstations from the network. After isolation, they delete the malware files and restore the systems from clean backups. Which two stages of the NIST lifecycle are the team performing?

   • AEradication, then Containment
   • BPreparation, then Detection and Analysis
   • CContainment, then Eradication and Recovery
   • DDetection and Analysis, then Post-Incident Activity
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A small retail company has just experienced a ransomware outbreak. The IT manager wants to restore operations quickly but also needs to preserve evidence for a possible law enforcement investigation. The company has no written incident response plan. Which action best aligns with the principles of an incident response plan?

   • APay the ransom immediately to restore access and avoid business disruption
   • BImmediately reimage all affected workstations and restore from the latest backups
   • CIsolate affected systems from the network, then document the scope of the infection before remediation
   • DDisconnect the internet connection for the entire company and wait for the attacker to stop
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst receives an alert about a possible malware infection on a server. The alert is based on a network signature that has a high false-positive rate. The analyst must decide whether to escalate the incident. The server is business-critical and cannot be taken offline without approval. Which action best balances the need for validation and the need to avoid unnecessary disruption?

   • AImmediately isolate the server from the network to prevent potential spread
   • BWait for additional alerts before taking any action
   • CCheck the endpoint detection and response (EDR) data for the server to confirm the presence of the malware before escalating
   • DEscalate the incident based on the network alert alone
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary goal of the containment stage in incident response?

   • ATo preserve evidence for legal proceedings
   • BTo identify the root cause of the incident
   • CTo restore systems to normal operation
   • DTo limit the spread and impact of an incident
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of an incident response procedure?

   • AA statement that the organization will comply with data breach notification laws
   • BA summary of the lessons learned from a previous incident
   • CA document that defines the roles and responsibilities of the incident response team
   • DA checklist that outlines the exact steps to isolate a compromised workstation
   Reveal Solution Discussion Select an answer first