Incident Response SY0-701 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security analyst is documenting the actions taken to contain an active malware infection. According to common incident response frameworks, which phase of the incident response process does containment fall under?

   • ADetection and Analysis
   • BPreparation
   • CContainment, Eradication, and Recovery
   • DPost-Incident Activity
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an investigation of a suspected data breach, the incident response team needs to collect evidence from a compromised server. The server is still running and is critical to business operations. The team must preserve evidence in a way that is admissible in court. Which action is the MOST appropriate FIRST step?

   • ADocument the system state and capture volatile data before any other action.
   • BPower off the server immediately to prevent further tampering.
   • CCapture a forensic image of the hard drive while the server is running.
   • DDisconnect the server from the network and leave it running.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An organization is establishing a formal process for handling security incidents. Which activity is typically performed during the preparation phase of the incident response process?

   • AIsolating infected systems to prevent further spread
   • BConducting forensic analysis on compromised devices
   • CIdentifying the root cause of a recent breach
   • DDeveloping and maintaining an incident response plan
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security operations center (SOC) analyst notices a pattern of small, encrypted data transfers from a database server to an external IP address during off-peak hours. The transfers have been occurring for several weeks and have not triggered any alerts. The analyst suspects data exfiltration. Which action should the analyst take FIRST?

   • AConduct a proactive threat hunt to identify the source of the transfers and any related malicious activity.
   • BRestore the database server from the last known-good backup.
   • CImmediately declare a data breach and notify senior management.
   • DBlock the external IP address at the firewall.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company experienced a data breach where customer data was exfiltrated. The investigation found that the attacker gained access through a phishing email that compromised a user's credentials. The user had multi-factor authentication (MFA) enabled, but the attacker used a phishing kit that intercepted the MFA token in real-time. The company has since reset the user's credentials and blocked the attacker's IP. Management wants to prevent a recurrence. Which action is the MOST direct application of root cause analysis?

   • AImplement a hardware security key requirement for all users.
   • BInvestigate why the phishing email bypassed the email security gateway.
   • CIncrease the frequency of security awareness training for all employees.
   • DAnalyze the phishing kit and the attacker's techniques to understand how the MFA token was intercepted.
   Reveal Solution Discussion Select an answer first