7.1 Identify Recommended Remediation Steps for Findings and Detections CCCS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A detection shows a host is beaconing to a C2 server. The host is a critical database server that cannot be isolated. The C2 server uses a domain name. What is the recommended remediation step?

   • ABlock the C2 domain in CrowdStrike to prevent DNS resolution and communication.
   • BIsolate the host despite the criticality.
   • CChange the host's DNS server to a different one.
   • DDisable the host's network adapter.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst must remediate a detection of a known malicious file on a user's laptop. The user is a CEO and the laptop contains sensitive data. The file is not critical to business operations. What is the recommended remediation step?

   • AAllow the file to run because the CEO needs the laptop.
   • BDelete the file immediately to remove the threat.
   • CIsolate the laptop without quarantining the file.
   • DQuarantine the file and then isolate the laptop for further investigation.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security team has a list of findings to remediate. Which factor should be considered FIRST when determining the order of remediation?

   • AThe age of the finding
   • BThe severity of the finding
   • CThe ease of remediation
   • DThe number of affected hosts
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A detection indicates that a host is running a known malicious process. Which remediation step is most appropriate to stop the process immediately?

   • AKill the process
   • BIsolate the host
   • CBlock the file hash
   • DReboot the host
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has a finding that a host is missing critical security patches. The host is a domain controller. The patch requires a reboot, which will cause downtime. What is the recommended remediation step?

   • AApply the patch immediately without regard for downtime.
   • BDefer the patch indefinitely to avoid downtime.
   • CIsolate the domain controller until the patch can be applied.
   • DApply the patch during a planned maintenance window to minimize downtime.
   Reveal Solution Discussion Select an answer first