1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which activity is part of the recovery phase of incident response?

   • AAnalyzing log files to identify the scope of the incident
   • BRestoring data from verified backups
   • CDisconnecting affected systems from the network
   • DDeleting malware from affected systems
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A web server was compromised through a vulnerable plugin. The incident response team has contained the server and confirmed the attacker's persistence mechanism. What should the team do next to eradicate the threat?

   • ARestore the server from a backup taken before the compromise.
   • BRemove the persistence mechanism and patch or update the vulnerable plugin.
   • CPlace the server back on the network and monitor for further activity.
   • DChange the server's IP address and continue operations.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which activity is a typical preparatory step in the incident response workflow?

   • ARestoring systems from verified backups
   • BConducting a lessons-learned meeting after an incident
   • CDeploying forensic imaging tools and establishing a secure evidence storage location
   • DIsolating affected systems from the network to prevent further spread
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is updating its incident response plan. The CISO wants to ensure that during a future incident, the right people are notified quickly and that evidence is not compromised. Which preparation activity is most directly aligned with this goal?

   • APerform a full backup of all servers and store the backups offsite.
   • BPurchase additional endpoint detection and response licenses.
   • CSchedule a company-wide security awareness training for all employees.
   • DDefine a communication tree with escalation contacts and create an evidence-handling checklist.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is an example of a preparation activity for incident response?

   • ADefining roles and responsibilities for the incident response team
   • BQuarantining a suspicious file on an endpoint
   • CDocumenting the timeline of events for a legal case
   • DIdentifying the root cause of a security breach
   Reveal Solution Discussion Select an answer first