A company's incident response plan requires that during a malware incident, the IT team must isolate affected systems. The plan does not specify the exact steps. The security team wants to ensure that isolation is performed consistently and correctly, even by less experienced staff. What is the best way to achieve this?

Purchase a new endpoint protection tool that automatically isolates systems

Add a high-level statement to the plan that says 'isolate affected systems'

Create a detailed isolation procedure with step-by-step instructions and verify it through tabletop exercises

Rely on the experience of senior IT staff to handle isolation

A security analyst notices an alert from the SIEM about a workstation making repeated outbound connections to a known command-and-control IP address. The analyst checks the workstation and sees that a suspicious process is running. According to the NIST incident response lifecycle, which stage is the analyst currently in?

Containment, Eradication, and Recovery

A company discovers that a server has been compromised by ransomware. The incident response team wants to prevent the ransomware from spreading to other servers while preserving evidence for forensic analysis. Which action should the team take first?

Notify the public relations team

Isolate the compromised server from the network

Delete the ransomware files from the server

Rebuild the server from a clean backup

After a major incident, the incident response team holds a lessons-learned meeting. The team identifies that the response was delayed because the on-call analyst did not know who to contact for approval to isolate a critical server. The team wants to improve the process. Which action is the most effective way to address this issue?

Replace the on-call analyst with a more experienced team member

Update the incident response plan to include a clear escalation and approval chain

Provide additional training on how to use the SIEM tool

Increase the frequency of security awareness training for all employees

A retail company is establishing its incident response capability. The security manager wants to ensure that the team can respond effectively when an incident occurs. Which combination of activities best represents the preparation stage?

Isolating infected systems and eradicating malware

Creating an incident response policy, acquiring forensic tools, and conducting training

Conducting a post-incident review and updating the plan

Monitoring network traffic and analyzing alerts

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 5Objective 4

Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 7)

Part of the Incident Handling domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 31–35

31expert · hard
A company's incident response plan requires that during a malware incident, the IT team must isolate affected systems. The plan does not specify the exact steps. The security team wants to ensure that isolation is performed consistently and correctly, even by less experienced staff. What is the best way to achieve this?
Select an answer first
32application · medium
A security analyst notices an alert from the SIEM about a workstation making repeated outbound connections to a known command-and-control IP address. The analyst checks the workstation and sees that a suspicious process is running. According to the NIST incident response lifecycle, which stage is the analyst currently in?
Select an answer first
33application · medium
A company discovers that a server has been compromised by ransomware. The incident response team wants to prevent the ransomware from spreading to other servers while preserving evidence for forensic analysis. Which action should the team take first?
Select an answer first
34expert · hard
After a major incident, the incident response team holds a lessons-learned meeting. The team identifies that the response was delayed because the on-call analyst did not know who to contact for approval to isolate a critical server. The team wants to improve the process. Which action is the most effective way to address this issue?
Select an answer first
35application · medium
A retail company is establishing its incident response capability. The security manager wants to ensure that the team can respond effectively when an incident occurs. Which combination of activities best represents the preparation stage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 7)

Questions 31–35

A company discovers that a server has been compromised by ransomware. The incident response team wants to prevent the ransomware from spreading to other servers while preserving evidence for forensic analysis. Which action should the team take first?

A retail company is establishing its incident response capability. The security manager wants to ensure that the team can respond effectively when an incident occurs. Which combination of activities best represents the preparation stage?

Keep studying — Incident Handling