1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a malware outbreak, the incident response team has contained the affected systems and collected forensic images. The team now needs to return the systems to normal operation. Which sequence of actions best aligns with the eradication and recovery phase?

   • APower on the systems and run a full antivirus scan to remove the malware.
   • BReconnect the systems and monitor them for any signs of reinfection.
   • CReimage the systems, apply security patches, restore data from clean backups, and verify the systems are functioning normally.
   • DRestore data from the most recent backups and reconnect the systems to the network immediately.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary objective of the eradication phase in incident response?

   • ATo document lessons learned from the incident
   • BTo isolate affected systems from the network
   • CTo remove the threat from affected systems
   • DTo restore systems to normal operation
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is establishing its incident response capability. The management wants to ensure that the team can respond effectively to incidents without delays. Which preparation activity is most important to achieve this?

   • APurchase the most advanced security tools available on the market.
   • BHire additional security analysts to monitor alerts 24/7.
   • CDefine roles and responsibilities for the incident response team and establish a communication plan.
   • DCreate a detailed incident response plan and store it in a secure location.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After a worm infection, the incident response team has contained the affected systems and collected forensic evidence. The team now needs to eradicate the worm from the environment. Which action is a key part of eradication?

   • ANotify external stakeholders about the incident.
   • BMonitor the network for any signs of the worm returning.
   • CIdentify and remove the root cause of the infection, such as an unpatched vulnerability.
   • DRestore all systems from the latest backups.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization has just detected a data breach and is in the process of confirming the scope of the incident. According to the incident response workflow, which phase should the organization complete before beginning containment?

   • ADetection and analysis
   • BEradication
   • CPost-incident activity
   • DRecovery
   Reveal Solution Discussion Select an answer first