5.4 Map Elements to These Steps of Analysis Based on the NIST.SP800-61 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A server is confirmed to be infected with ransomware. The incident response team has isolated the server from the network and is now deciding how to proceed. According to NIST.SP800-61, which action belongs to the eradication step?

   • AMonitoring the server for signs of reinfection
   • BDisconnecting the server from the network
   • CRemoving the ransomware binary and restoring the system from a clean backup
   • DConducting a lessons-learned meeting
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst is investigating a suspicious email that was opened by an employee. The email contained a link to a website that downloaded a file. The analyst has confirmed that the file is malware. According to NIST.SP800-61, what should the analyst do NEXT?

   • AReport the incident to law enforcement
   • BDelete the malware from the employee's computer
   • CDetermine the scope of the infection by checking if other systems are affected
   • DImmediately disconnect the employee's computer from the network
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an incident, a compromised web server is isolated from the network. The malware has been removed, and the server has been rebuilt from a known-good image. According to NIST.SP800-61, which activity should be performed NEXT to complete the Containment, Eradication, and Recovery phase?

   • ADocument the incident timeline and evidence collected
   • BRestore the server to production and monitor it for signs of reinfection
   • CConduct a lessons-learned meeting with the incident response team
   • DUpdate the incident response plan based on the incident findings
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company's web server is compromised and is being used to mine cryptocurrency. The server is also hosting a critical customer-facing application that cannot be offline for more than 30 minutes. The incident response team has confirmed the compromise and identified the malicious process. According to NIST.SP800-61, which sequence of actions best balances containment, eradication, and business continuity?

   • AIsolate the server from the network, kill the malicious process, remove the malware, restore the application, and monitor for reinfection
   • BKill the malicious process, then immediately restore the application without isolating the server
   • CDisconnect the server, conduct a full forensic analysis, then rebuild the server and return it to service
   • DRebuild the server from a clean image, then conduct a lessons-learned meeting before bringing it back online
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst notices repeated failed login attempts from a single external IP against the company's VPN gateway. The attempts have been ongoing for 30 minutes and are increasing in frequency. According to NIST.SP800-61, what is the analyst's NEXT step in the Detection and Analysis phase?

   • ADisable the VPN service to prevent further access
   • BValidate the alert by correlating with other logs and determining if any successful logins occurred
   • CEscalate the alert to the CSIRT manager for immediate incident declaration
   • DBlock the external IP at the firewall immediately
   Reveal Solution Discussion Select an answer first