1.3 Apply the Playbook for a Common Scenario Such as Unauthorized Elevation of Privilege, DoS and DDoS, Website Defacement 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a playbook for an unauthorized elevation of privilege incident, which action is typically performed FIRST after the incident is detected?

   • AEradicate the threat by deleting all user accounts on the affected systems
   • BDocument the incident in the lessons learned report
   • CContain the affected accounts and systems to prevent further unauthorized access
   • DRecover by restoring all systems from backup immediately
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A website is defaced, and the incident response team is following the defacement playbook. After containing the incident and preserving evidence, the team needs to restore the website to its original state. Which action should be taken during the recovery phase?

   • ANotify the web hosting provider about the incident.
   • BRemove the defaced content from the live site without taking it offline.
   • CChange all administrative passwords and review user accounts.
   • DRestore the website from a known-good backup and verify the integrity of the restored files.
   Reveal Solution Discussion Select an answer first
4. 13application · medium · select all that apply

   A website is defaced, and the incident response team is following the defacement playbook. Select all actions that are appropriate during the eradication phase.

   • ARemove any backdoors or malicious files from the web server.
   • BChange all administrative passwords and review user accounts.
   • CTake the website offline to prevent further defacement.
   • DUpdate the vulnerable plugin that was exploited.
   • ERestore the website from a clean backup.
   Check answers Discussion Select an answer first
5. 14application · medium

   After a website defacement, the incident response team has contained the incident and identified the vulnerability that was exploited. Which action is part of the recovery phase?

   • ATake the website offline and preserve the defaced page.
   • BPatch the vulnerability and restore the website from a clean backup.
   • CNotify the website hosting provider about the incident.
   • DReview the web server logs to determine how the attacker gained access.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is experiencing a DDoS attack that is targeting its DNS servers. The attack is causing intermittent outages for customers. The security team has a mitigation plan that includes rate limiting and traffic filtering. However, the team is unsure whether the attack is a reflection attack or a direct attack. Which action is most appropriate to determine the attack type?

   • ABlock all DNS traffic from external sources.
   • BIncrease the DNS server capacity.
   • CImmediately implement rate limiting on the DNS servers.
   • DAnalyze the source IP addresses and packet sizes.
   Reveal Solution Discussion Select an answer first