1.3 Apply the Playbook for a Common Scenario Such as Unauthorized Elevation of Privilege, DoS and DDoS, Website Defacement 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's e-commerce website is experiencing intermittent slowdowns. Network monitoring shows a sudden spike in inbound UDP traffic to port 53 from thousands of unique IP addresses. The traffic is not legitimate DNS queries. According to the DDoS playbook, what is the FIRST mitigation step to implement?

   • ABlock all UDP traffic at the perimeter firewall.
   • BEnable rate limiting on the DNS server for incoming queries.
   • CDeploy or activate a DDoS protection service that filters traffic based on known attack signatures.
   • DContact the ISP to request blackholing of the attack traffic.
   Reveal Solution Discussion Select an answer first
2. 17application · medium · select all that apply

   An organization is responding to an unauthorized elevation of privilege incident. The attacker used a compromised service account to add themselves to the Domain Admins group. Select all actions that are appropriate during the containment phase of the playbook.

   • ADisable the compromised service account.
   • BReset the password of the compromised service account.
   • CCollect forensic evidence from the domain controller.
   • DRevoke the attacker's membership in the Domain Admins group.
   • EIsolate the affected systems from the network.
   Check answers Discussion Select an answer first
4. 18application · medium

   A company's public website displays an unauthorized message. The incident response team suspects the web server was compromised. According to the website defacement playbook, which action should be taken FIRST?

   • AVerify the website's integrity and confirm the defacement.
   • BRestore the website from the last known good backup.
   • CNotify the public relations team and prepare a press release.
   • DTake the website offline and preserve the defaced page.
   Reveal Solution Discussion Select an answer first
5. 19application · hard

   An organization has separate playbooks for unauthorized elevation of privilege and DDoS attacks. During a security incident, the team notices that a DDoS attack is being used as a distraction while an attacker attempts to escalate privileges on a critical server. Which playbook should the team follow?

   • AFollow both playbooks simultaneously, assigning different teams to each.
   • BFollow the DDoS playbook first because it is the most visible attack.
   • CFollow the elevation of privilege playbook first because it is the more critical threat.
   • DFollow the DDoS playbook and ignore the elevation of privilege until the DDoS is resolved.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   During the eradication phase of an unauthorized elevation of privilege incident, what is a key objective?

   • AIdentify the root cause of the vulnerability that allowed the privilege escalation
   • BIsolate the affected systems from the network to stop the spread
   • CRestore the affected systems to normal operation and verify functionality
   • DRemove the attacker's access and any backdoors or malicious files from the affected systems
   Reveal Solution Discussion Select an answer first