7.1 Identify Recommended Remediation Steps for Findings and Detections CCCS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst sees a detection for a suspicious PowerShell command on a single Windows workstation. The command is attempting to download a file from a known malicious URL. The user is still logged on and active. What is the recommended first remediation step?

   • AIsolate the host immediately to stop the download and prevent lateral movement.
   • BBlock the malicious URL in the firewall to prevent the download.
   • CKill the PowerShell process from the console to stop the command.
   • DDisable the user account to stop the user from executing more commands.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team has two detections: one on a domain controller and one on a workstation. Both are medium severity. Which should be prioritized for remediation?

   • AThe workstation, because it is more likely to be compromised.
   • BThe domain controller, because it has higher impact if compromised.
   • CThe one that was detected first.
   • DBoth equally, because they have the same severity.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A finding indicates that a host has a vulnerability that could allow remote code execution. The host is internet-facing. What is the recommended remediation step?

   • AIsolate the host from the internet to reduce exposure.
   • BApply the vendor patch to the host as soon as possible.
   • CBlock the vulnerability's CVE in CrowdStrike.
   • DMonitor the host for exploitation attempts.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A detection shows that a host is beaconing to a command-and-control (C2) server. The host is a critical production server that cannot be isolated. What is the recommended remediation step?

   • AReboot the host to clear the beaconing process.
   • BDisable the network adapter on the host to cut off communication.
   • CBlock the C2 indicator in CrowdStrike to prevent further communication.
   • DIsolate the host despite the criticality to stop the beaconing.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A detection identifies a file as malware on a user's laptop. The file is not critical to business operations. What is the recommended remediation step for this finding?

   • AIsolate the laptop to prevent the file from spreading.
   • BDelete the file from the laptop immediately.
   • CAllow the file to run because it is on a user's laptop.
   • DQuarantine the file to prevent it from executing.
   Reveal Solution Discussion Select an answer first