1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which action is an example of a short-term containment measure?

   • ADisabling a compromised user account
   • BConducting a forensic analysis of the affected system
   • CApplying a security patch to close the exploited vulnerability
   • DRebuilding the affected server from a known-good image
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is establishing its incident response capability. Management wants to ensure that evidence collected during an incident will be admissible in legal proceedings. Which preparatory action is most important?

   • AEstablish a communication plan with external legal counsel.
   • BTrain employees on phishing awareness.
   • CDefine and document evidence handling procedures, including chain of custody forms.
   • DPurchase advanced endpoint detection and response (EDR) tools.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company experiences a data breach. The incident response team is in the containment phase and has isolated the affected systems. The CEO wants to know when the business can return to normal operations. Which phase of the incident response workflow should the team complete before business operations can fully resume?

   • ADetection and analysis phase, which confirms the scope of the incident.
   • BRecovery phase, which includes restoring systems and verifying normal operation.
   • CPost-incident activity phase, which includes lessons learned.
   • DEradication phase, which removes the threat from the environment.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst discovers that a critical database server is infected with a memory-resident rootkit. The server cannot be taken offline because it supports a 24/7 customer-facing application. The analyst must contain the threat while preserving evidence and maintaining service. Which approach best balances these competing requirements?

   • ADisconnect the server and wait for the next maintenance window to rebuild it.
   • BImmediately power off the server to stop the rootkit and then restore from backup.
   • CIsolate the server at the network level, capture a memory dump, and then fail over to a standby server before rebuilding the infected host.
   • DKeep the server online and attempt to remove the rootkit with an antivirus tool.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   After containing and eradicating a ransomware outbreak, the incident response team is preparing the final report. The legal department requests a detailed timeline of actions taken by each team member. The security operations manager wants to focus on technical root cause. Which approach best satisfies both stakeholders?

   • APublish the full technical report to all employees to ensure transparency.
   • BProvide legal with the raw incident ticket history and give the manager a separate technical summary.
   • CProduce a single report with an executive summary, a technical root-cause section, and a chronological action log with timestamps and responsible parties.
   • DDelay the report until the next quarterly review to gather more data.
   Reveal Solution Discussion Select an answer first