Incident Management Life Cycle CS0-003 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which tool is specifically designed to collect and analyze volatile data from a running system during incident response?

   • ANetwork scanner (e.g., Nmap)
   • BMemory forensics tool (e.g., Volatility)
   • CVulnerability scanner (e.g., Nessus)
   • DWeb application firewall (WAF)
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An incident responder is investigating a possible malware infection on a Linux server. The responder suspects that the malware is running as a process and has modified system files. The responder needs to preserve evidence for forensic analysis. Which action should the responder take first?

   • ACopy the system files to a backup location
   • BReboot the server to stop the malware
   • CRun a full antivirus scan on the server
   • DCapture a memory dump of the server
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's disaster recovery plan relies on a single backup vendor. During a recent incident, the backup vendor experienced an outage, and the company could not restore critical systems. Management wants to improve resilience without significantly increasing costs. Which action is most effective?

   • ANegotiate a service-level agreement (SLA) with the backup vendor that includes penalties for outages
   • BIncrease the frequency of backups to the current vendor
   • CMove all backups to on-premises storage
   • DImplement a secondary backup solution with a different vendor
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a common practice in business continuity planning?

   • AOutsourcing all IT operations to a single vendor
   • BDeleting all backup data to reduce storage costs
   • CDisabling all network security controls to improve performance
   • DConducting a business impact analysis (BIA) to identify critical functions
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is creating a playbook for handling phishing emails that contain malicious attachments. The playbook should provide step-by-step instructions for the initial response, including containment and eradication. Which component is essential for the playbook to be effective?

   • ASpecific technical steps for isolating affected hosts and removing the malware
   • BA list of all employees' email addresses for notification
   • CA copy of the company's business continuity plan
   • DA detailed escalation path and list of stakeholders to contact
   Reveal Solution Discussion Select an answer first