1.3 Apply the Playbook for a Common Scenario Such as Unauthorized Elevation of Privilege, DoS and DDoS, Website Defacement 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A marketing website is defaced, and the homepage is replaced with unauthorized content. The web server logs show that the attacker used a previously patched vulnerability in a third-party plugin. The incident response team is following the website defacement playbook. After confirming the defacement, which action should be taken NEXT?

   • AUpdate the plugin to the latest version.
   • BRestore the website from the latest backup.
   • CTake the website offline and preserve the defaced page as evidence.
   • DNotify the marketing team and ask them to review the content.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following correctly sequences the common phases of an incident response playbook?

   • APreparation, Analysis, Detection, Containment, Recovery, Eradication, Lessons Learned
   • BDetection, Analysis, Preparation, Containment, Eradication, Lessons Learned, Recovery
   • CPreparation, Detection, Analysis, Containment, Eradication, Recovery, Lessons Learned
   • DDetection, Preparation, Analysis, Eradication, Containment, Recovery, Lessons Learned
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is responding to a website defacement. The team has identified that the attacker used a SQL injection vulnerability to modify the website content. The team has contained the incident and is now in the eradication phase. Which action is most appropriate for this phase?

   • ARemove the malicious content and patch the SQL injection vulnerability.
   • BRestore the website from a backup that includes the malicious content.
   • CNotify the database administrator about the SQL injection.
   • DDisable the web server to prevent further access.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   During an elevation-of-privilege incident, the security team discovers that the attacker used a legitimate administrative account to create a new backdoor account. The team has contained the incident by disabling the compromised account and the backdoor account. However, the team is unsure whether the attacker left any other persistence mechanisms. Which action is most important during the eradication phase?

   • ANotify the legal department about the incident.
   • BSearch for other unauthorized accounts and scheduled tasks.
   • CRestore the affected systems from backup.
   • DChange the passwords of all administrative accounts.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In a website defacement playbook, what is the FIRST step after confirming that a website has been defaced?

   • AAnalyze the defacement page to identify the attacker's motive
   • BIsolate the affected web server to prevent further unauthorized changes
   • CRestore the website from the most recent backup
   • DNotify the public about the defacement
   Reveal Solution Discussion Select an answer first