7.1 Identify Recommended Remediation Steps for Findings and Detections CCCS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst must remediate two detections: a high-severity ransomware on a file server and a medium-severity credential theft on a domain controller. The file server is already isolated. The domain controller is not isolated. Which action should the analyst take first?

   • AFocus on the file server because it has higher severity.
   • BWait for the file server remediation to complete before addressing the domain controller.
   • CBlock the ransomware indicator on the file server.
   • DIsolate the domain controller to prevent credential theft from spreading.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization has a limited security team and must remediate multiple detections. Which approach should they take to prioritize remediation actions?

   • ARemediate detections in the order they were detected.
   • BRemediate the easiest detections first to clear the queue quickly.
   • CRemediate the most severe detections first, considering their potential impact.
   • DRemediate detections that affect the most users first.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A finding shows that a host has a known vulnerability in a third-party application. The vendor has not released a patch yet. What is the recommended remediation step?

   • AIsolate the host until a patch is available.
   • BUninstall the third-party application.
   • CMonitor the host for exploitation attempts.
   • DApply a workaround or mitigation recommended by the vendor.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A detection shows that a host is attempting to communicate with a known malicious IP address. The host is a critical database server that cannot be isolated. What is the recommended remediation step?

   • ABlock the malicious IP address in CrowdStrike.
   • BDisable the host's network adapter.
   • CIsolate the host despite the criticality.
   • DChange the host's DNS settings to prevent resolution.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team has three detections: a low-severity adware on a kiosk, a medium-severity phishing email that was opened by a user, and a high-severity ransomware on a file server. The file server is already isolated. Which detection should be remediated next?

   • AAll three at the same time, because they all need attention.
   • BThe adware on the kiosk, because it is low severity and easy to remediate.
   • CThe phishing email, because the user may have clicked a malicious link.
   • DThe ransomware on the file server, because it has the highest severity.
   Reveal Solution Discussion Select an answer first