1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a significant data breach, the incident response team discovers that customer data was exfiltrated. The legal department instructs the team not to share details with external parties yet. However, the public relations team wants to issue a statement to customers. What should the incident response team do?

   • AFollow the legal department's instruction and coordinate with them before any external communication.
   • BIgnore legal and focus on technical containment.
   • CAllow PR to issue a statement because customers have a right to know.
   • DAsk the PR team to issue a vague statement without mentioning the breach.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During an incident, a forensic analyst needs to collect a memory image from a compromised server. The server is still running and connected to the network. Which action should the analyst take to preserve evidence integrity?

   • ACopy the memory image to the server's local hard drive.
   • BRun the capture tool from the compromised system's own disk.
   • CPower off the server before capturing memory.
   • DUse a trusted forensic tool to capture memory to an external write-blocked device.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization has identified a compromised domain controller. The incident response team needs to contain the incident while preserving the ability to investigate. Which containment strategy best balances these needs?

   • ADisconnect the domain controller from the network but keep it powered on.
   • BShut down the domain controller immediately.
   • CRestore the domain controller from a backup.
   • DChange the domain controller's IP address and leave it on the network.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst receives an alert about a suspicious login from an unusual geographic location. The analyst checks the user's recent activity and sees that the user is currently in a meeting in the office. What should the analyst do?

   • AIgnore the alert because the user is in the office.
   • BTreat the alert as a potential incident and investigate further by correlating with other indicators.
   • CContact the user to ask if they logged in from that location.
   • DImmediately disable the user's account.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During an incident, the incident response team needs to collect a hard drive from a compromised server for forensic analysis. The server is still running and the team wants to preserve evidence. What is the proper procedure?

   • APower off the server, remove the hard drive, and use a write blocker to create a forensic image.
   • BCopy the hard drive while the server is running using standard copy commands.
   • CRun a disk repair tool before imaging the drive.
   • DRemove the hard drive without powering off the server.
   Reveal Solution Discussion Select an answer first