1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization is developing its incident response plan. The plan must address the possibility of a ransomware attack that could affect both on-premises and cloud systems. Which preparatory measure is most important to ensure an effective response?

   • AEstablishing clear roles and responsibilities for the incident response team, including cloud-specific escalation paths.
   • BDeveloping a communication plan for notifying customers of a breach.
   • CPurchasing additional cloud security tools.
   • DCreating a backup strategy that includes both on-premises and cloud data.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An organization discovers that an attacker has compromised a database server and is actively exfiltrating sensitive customer data. The incident response team must contain the incident while preserving evidence for a potential lawsuit. Which containment strategy best balances these competing needs?

   • ADisconnect the database server from the network but keep it powered on and capture memory before disconnecting.
   • BShut down the database server immediately to stop the exfiltration.
   • CBlock the attacker's IP address at the firewall and leave the server running.
   • DRestore the database server from a backup taken before the compromise.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network analyst sees a sudden spike in outbound traffic from a file server to an external IP address on port 443. The traffic pattern is periodic and occurs every 5 minutes. The analyst suspects a data exfiltration. What should the analyst do next to confirm and scope the incident?

   • AReboot the file server to terminate any malicious processes.
   • BReview the file server's logs and correlate the traffic with running processes and user activity.
   • CImmediately block the external IP address at the firewall.
   • DDisconnect the file server from the network and declare the incident contained.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of maintaining a chain of custody for evidence collected during an incident?

   • ATo speed up the incident response process
   • BTo prevent the attacker from accessing the evidence
   • CTo reduce the cost of forensic analysis
   • DTo ensure the evidence is admissible in legal proceedings
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of external coordination during an incident?

   • AConducting a post-incident review with the IR team
   • BNotifying law enforcement about a suspected criminal activity
   • CAnalyzing logs from the affected systems
   • DUpdating the internal incident response plan
   Reveal Solution Discussion Select an answer first