1.3 Apply the Playbook for a Common Scenario Such as Unauthorized Elevation of Privilege, DoS and DDoS, Website Defacement 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A website defacement incident has been contained, and the team is preparing to restore the site. The team has a backup from before the incident, but they are unsure whether the backup is clean. Which action is most appropriate to ensure the restored site is not compromised?

   • ARebuild the website from scratch without using any backup.
   • BUse a backup from an older date without checking it.
   • CScan the backup for malware and verify the integrity of the files.
   • DRestore the backup immediately to minimize downtime.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is developing a playbook for a scenario that involves both a DDoS attack and a potential elevation of privilege. The team has limited resources and must decide how to allocate them. Which approach is MOST appropriate?

   • AFocus all resources on investigating the elevation of privilege because it is more critical.
   • BFocus all resources on mitigating the DDoS attack because it is more visible.
   • CWait for more information before deciding which incident to address.
   • DSplit resources between the two incidents, prioritizing the elevation of privilege while maintaining basic DDoS mitigation.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a suspected DDoS attack, the security team needs to differentiate it from a legitimate traffic spike. Which action is most appropriate for this scenario?

   • ACheck the source IP diversity and packet characteristics.
   • BIncrease the server capacity to handle the load.
   • CRestart the web server to clear the load.
   • DImmediately block all traffic from the top source IPs.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst detects that a standard user account has been granted Domain Admin privileges. The change was made using a compromised administrator account. According to the elevation of privilege playbook, which action should be taken during the eradication phase?

   • AReset the password of the compromised administrator account and revoke the elevated privileges.
   • BNotify the user whose account was elevated.
   • CDisconnect the affected servers from the network.
   • DCollect forensic images of the domain controller.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard · select all that apply

   An organization is developing playbooks for three common scenarios: unauthorized elevation of privilege, DDoS, and website defacement. The team wants to ensure that the playbooks are distinct and appropriate for each scenario. Select all statements that correctly differentiate the playbooks.

   • AThe defacement playbook focuses on restoring the website from backup.
   • BThe elevation of privilege playbook focuses on identifying and revoking unauthorized access.
   • CThe DDoS playbook focuses on traffic filtering and rate limiting.
   • DAll three playbooks have the same containment steps.
   • EThe elevation of privilege playbook includes steps for resetting compromised credentials.
   Check answers Discussion Select an answer first