1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After a ransomware incident is contained and eradicated, the incident response team conducts a post-incident review. The review identifies that the initial detection was delayed because the security operations center (SOC) did not have a documented escalation path for suspicious alerts. Which action best addresses this finding?

   • AReplace the SOC team with more experienced analysts.
   • BDelete all logs from the incident to free up storage space.
   • CUpdate the incident response plan to include a clear escalation matrix and communication protocols.
   • DIncrease the frequency of vulnerability scans across the network.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A forensic investigator is collecting evidence from a compromised server. The server is part of a cluster and must remain available for business operations. The investigator needs to preserve evidence without taking the server offline. Which approach best meets both requirements?

   • APerform a live forensic acquisition of memory and disk while the server remains online.
   • BTake the server offline to perform a dead forensic acquisition.
   • CCopy the server's data to a network share and analyze it there.
   • DWait until the server can be taken offline during a maintenance window.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security operations center (SOC) receives an alert about a possible malware infection on a finance department workstation. The alert is based on a single endpoint detection and response (EDR) signal. The SOC analyst must decide whether to escalate the incident. The company has a low tolerance for false positives. What should the analyst do first?

   • AQuarantine the workstation based on the single EDR alert.
   • BCorrelate the EDR alert with other logs, such as network traffic and authentication events, to confirm the indicator.
   • CIgnore the alert because EDR alerts are often false positives.
   • DEscalate the alert immediately to the incident response team to avoid missing a real threat.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An incident response team is handling a malware infection that has spread to multiple systems. The team has contained the spread and is now deciding whether to begin eradication or first conduct a deeper analysis of the malware's capabilities. Which consideration is most important in this decision?

   • AThe need to preserve evidence for legal proceedings.
   • BThe desire to restore systems to normal operation as quickly as possible.
   • CThe need to understand the malware's behavior to ensure complete eradication.
   • DThe cost of additional analysis tools.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During an active incident, the incident response team discovers that the attack originated from a partner organization's network. The team needs to coordinate with the partner to stop the attack. What should the team do?

   • APost a public message on the partner's social media page.
   • BContact the partner's security team through the pre-established communication channel.
   • CBlock all traffic from the partner's IP range without notifying them.
   • DWait until the incident is fully contained before contacting the partner.
   Reveal Solution Discussion Select an answer first