1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security analyst detects a worm spreading across the corporate network. The incident response team needs to stop the spread immediately while preserving forensic evidence for later analysis. Which action should the team take first?

   • APower off the affected systems to prevent further damage.
   • BIsolate affected systems from the network by disconnecting their switch ports.
   • CApply the latest antivirus signatures to the affected systems.
   • DReimage the affected systems from a known-good backup.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During a major security incident, the incident response team needs to coordinate with external parties, including law enforcement and a third-party forensic firm. Which action best supports effective coordination?

   • ALimit communication to written emails only.
   • BAllow each team member to communicate directly with external parties to speed up information sharing.
   • CDelay communication until the incident is fully resolved.
   • DEstablish a single point of contact for each external party and document all communications.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An organization has just experienced a security incident. The incident response team has completed the containment and eradication phases. According to the incident response workflow, what should the team do next?

   • AMove directly to post-incident activities and write the lessons-learned report.
   • BRepeat the detection and analysis phase to ensure no other systems are affected.
   • CBegin the recovery phase by restoring systems and verifying normal operation.
   • DConduct a new preparation phase to update the incident response plan.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security analyst detects a suspicious process running on a critical server. The process is making outbound connections to a known command-and-control (C2) domain. The analyst must confirm the incident without disrupting the investigation. Which action is most appropriate?

   • ACapture network traffic and memory from the server while allowing the C2 connection to continue temporarily.
   • BKill the suspicious process immediately.
   • CImmediately block the C2 domain at the firewall.
   • DDisconnect the server from the network.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which activity is part of the detection and analysis phase of incident response?

   • ACorrelating log entries to identify a pattern of unauthorized access
   • BRebuilding the operating system on an affected host
   • CDisconnecting a compromised server from the network
   • DConducting a post-incident review with stakeholders
   Reveal Solution Discussion Select an answer first