A security operations center receives an alert that a workstation has been making unusual outbound connections to a known malicious IP address. The analyst checks the endpoint detection and response (EDR) tool and confirms that a suspicious process is running. According to the NIST incident response lifecycle, what should the analyst do next?

Update the incident response policy

Ignore the alert because it is only a single workstation

Declare the incident and move to containment

Reimage the workstation immediately

During a ransomware incident, the incident response team discovers that the ransomware is spreading through a network share. The team needs to contain the spread, but the share is used by multiple departments for critical files. The business wants to keep the share available. Which containment strategy best balances the need to stop the spread with the business need for availability?

Disconnect all users from the network immediately

Delete the network share and restore it from backup

Leave the share enabled and rely on endpoint protection to stop the ransomware

Disable the network share temporarily and provide read-only access to approved users

Which activity is part of the eradication stage of incident response?

Removing malware from affected systems

Monitoring network traffic for signs of intrusion

Conducting a post-incident review

After containing a worm that spread through a network share, the incident response team needs to remove the worm from all affected systems and restore them to normal operation. Which sequence of actions best represents the eradication and recovery stage?

Restore data from backups, then delete the malicious files

Delete the malicious files, patch the vulnerability, then restore data from clean backups

Patch the vulnerability, then immediately reconnect all systems to the network

Power off all systems and wait for the worm to die

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 5Objective 4

Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 3)

Part of the Incident Handling domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 11–15

11application · medium
A security operations center receives an alert that a workstation has been making unusual outbound connections to a known malicious IP address. The analyst checks the endpoint detection and response (EDR) tool and confirms that a suspicious process is running. According to the NIST incident response lifecycle, what should the analyst do next?
Select an answer first
12expert · hard
During a ransomware incident, the incident response team discovers that the ransomware is spreading through a network share. The team needs to contain the spread, but the share is used by multiple departments for critical files. The business wants to keep the share available. Which containment strategy best balances the need to stop the spread with the business need for availability?
Select an answer first
13foundation · easy
Which activity is part of the eradication stage of incident response?
Select an answer first
14application · medium
After containing a worm that spread through a network share, the incident response team needs to remove the worm from all affected systems and restore them to normal operation. Which sequence of actions best represents the eradication and recovery stage?
Select an answer first
15foundation · easy
According to NIST SP 800-61, which of the following is one of the four phases of the incident response lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 3)

Questions 11–15

Which activity is part of the eradication stage of incident response?

After containing a worm that spread through a network share, the incident response team needs to remove the worm from all affected systems and restore them to normal operation. Which sequence of actions best represents the eradication and recovery stage?

According to NIST SP 800-61, which of the following is one of the four phases of the incident response lifecycle?

Keep studying — Incident Handling