1.3 Apply the Playbook for a Common Scenario Such as Unauthorized Elevation of Privilege, DoS and DDoS, Website Defacement 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   During the recovery phase of a website defacement incident, what action is essential to ensure the site is restored securely?

   • AChange the website's domain name to avoid further attacks
   • BDelete all website logs to remove any traces of the attacker
   • CPatch the vulnerability that allowed the defacement before putting the site back online
   • DRestore the website from a backup that was taken before the defacement
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   An organization is updating its incident response playbooks. The team wants to ensure that the playbooks are effective for both technical and non-technical stakeholders. Which element is MOST important to include in the playbook to achieve this?

   • AClear roles and responsibilities for each team member and communication guidelines.
   • BA list of all possible indicators of compromise for the scenario.
   • CDetailed technical steps for each phase of the incident response.
   • DA timeline of expected actions and milestones for the response.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An incident response team is creating a playbook for a new type of incident that does not fit the standard categories. The team wants to ensure the playbook is flexible enough to handle unknown scenarios. Which approach is most appropriate?

   • AUse a generic playbook that follows the standard phases and allows for customization.
   • BUse a playbook from another organization without modification.
   • CSkip the playbook and rely on the team's experience.
   • DCreate a detailed playbook for every possible incident type.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's e-commerce site is experiencing a DDoS attack that is overwhelming the application layer. The team has confirmed the attack and identified the traffic pattern. Which action is most appropriate for the containment phase?

   • AImplement rate limiting on the web application firewall.
   • BAnalyze the attack traffic to identify the botnet's command and control servers.
   • CRebuild the web servers from a clean image.
   • DDisconnect the e-commerce site from the internet.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   In an incident response playbook, which phase involves reviewing the incident to identify improvements for future responses?

   • ARecovery
   • BLessons Learned
   • CContainment
   • DAnalysis
   Reveal Solution Discussion Select an answer first