1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 11)

Questions 51–53

1. 51foundation · easy

   Which activity is typically performed during the post-incident phase?

   • AUpdating the incident response plan based on lessons learned
   • BIsolating the affected network segment
   • CCollecting forensic evidence from the affected system
   • DRebuilding the compromised server
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   What is the primary purpose of analyzing indicators of compromise (IOCs) during the detection and analysis phase?

   • ATo identify the root cause and remove it from the environment
   • BTo restore affected systems to their normal operating state
   • CTo confirm whether an incident has occurred and determine its scope
   • DTo immediately contain the threat and prevent further damage
   Reveal Solution Discussion Select an answer first
3. 53application · medium

   A security analyst notices unusual outbound traffic from a database server to an unknown IP address. The analyst suspects a data exfiltration incident. What should the analyst do first to confirm the incident?

   • ANotify law enforcement immediately.
   • BCorrelate the traffic with other logs and indicators of compromise.
   • CDisconnect the database server from the network.
   • DImmediately block the outbound IP address.
   Reveal Solution Discussion Select an answer first