1.3 Apply the Playbook for a Common Scenario Such as Unauthorized Elevation of Privilege, DoS and DDoS, Website Defacement 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is experiencing a DDoS attack that is targeting their public-facing web application. The attack is a mix of volumetric and application-layer traffic. The team has a DDoS protection service, but the attack is evolving. The company also has a contractual obligation to maintain 99.9% uptime. Which mitigation strategy is MOST effective while minimizing impact on legitimate users?

   • ABlock all traffic from the source IPs identified in the attack.
   • BIncrease the bandwidth and server capacity to absorb the attack.
   • CRate-limit all incoming traffic to the web application.
   • DUse a combination of traffic filtering, rate limiting, and web application firewall rules.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which response action is uniquely associated with a website defacement incident as opposed to an elevation of privilege or DDoS incident?

   • ARevoking the attacker's access tokens
   • BEnabling rate limiting on the network firewall
   • CRestoring the affected web content from a known good backup
   • DResetting the passwords of all user accounts
   Reveal Solution Discussion Select an answer first
4. 28application · easy

   A security team is developing a playbook for responding to a common incident type. They want the playbook to be effective across different teams and situations. What is the PRIMARY purpose of documenting a playbook?

   • ATo provide a step-by-step guide that standardizes response actions and reduces decision-making during an incident.
   • BTo document the root cause of every incident for compliance reporting.
   • CTo list all possible attack scenarios and their indicators of compromise.
   • DTo replace the need for skilled incident responders by automating all response steps.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst discovers that a service account has been granted local administrator rights on multiple servers. The change was made through a compromised administrative account. Which action is part of the eradication phase of the elevation-of-privilege playbook?

   • ADisable the compromised administrative account.
   • BRemove the unauthorized local administrator rights from the service account.
   • CNotify the system owners about the incident.
   • DCollect logs from the affected servers.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   After a DDoS attack has been mitigated, what is a key step in the recovery phase of the playbook?

   • AImmediately implement all possible security measures to prevent any future attack
   • BIdentify the source IP addresses of the attackers to pursue legal action
   • CVerify that the service is fully functional and that legitimate traffic is flowing normally
   • DDelete all logs related to the attack to free up storage space
   Reveal Solution Discussion Select an answer first