1.3 Apply the Playbook for a Common Scenario Such as Unauthorized Elevation of Privilege, DoS and DDoS, Website Defacement 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is responding to an incident where a user account was used to access sensitive data without authorization. The analyst must determine whether this is an elevation-of-privilege incident or a different type. Which finding would most strongly indicate an elevation-of-privilege incident?

   • AThe user accessed the data during business hours.
   • BThe user accessed the data using a VPN.
   • CThe user accessed the data from a new device.
   • DThe user account was granted additional permissions just before the access.
   Reveal Solution Discussion Select an answer first
2. 32application · easy

   After a security incident, the incident response team conducts a lessons learned review. Which activity is typically performed during this phase?

   • AIdentifying the root cause of the incident.
   • BRestoring systems from backup and verifying functionality.
   • CDocumenting what went well and what could be improved in the response process.
   • DDeploying additional security controls to prevent recurrence.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is responding to a suspected DDoS attack. The team has limited resources and must decide whether to focus on mitigation or on identifying the attacker. Which approach is most aligned with the DDoS playbook?

   • AFocus equally on mitigation and attribution from the start.
   • BPrioritize mitigation to restore service, then analyze the attack for attribution.
   • CIgnore attribution and only focus on mitigation.
   • DPrioritize identifying the attacker before taking any mitigation action.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which tool or technique is most commonly used to mitigate a DDoS attack, but is NOT typically used for an elevation of privilege or defacement incident?

   • AFile integrity monitoring to detect unauthorized changes
   • BTraffic scrubbing service that filters malicious traffic
   • CEndpoint detection and response (EDR) to identify malicious processes
   • DPrivileged access management to restrict administrative accounts
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   During an elevation-of-privilege incident, the security team finds that the attacker exploited a misconfigured service account that had domain admin rights. The team has removed the rights and disabled the account. However, the team is concerned that the attacker may have used the account to access other systems. Which action is most important during the recovery phase?

   • ARestore all systems from backup.
   • BChange the password of the service account.
   • CNotify the service account owner about the incident.
   • DAudit the account's activity logs to determine the scope of access.
   Reveal Solution Discussion Select an answer first