Computer Forensics and Incident Response ACCISO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company experiences a malware outbreak that affects multiple servers. The security team must contain the incident while minimizing business disruption. Which containment strategy is most appropriate?

   • ADisconnect all affected servers from the network immediately.
   • BIsolate only the critical servers that are actively spreading malware.
   • CShut down the entire network until the malware is eradicated.
   • DImplement network segmentation and block malicious traffic at the firewall.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A ransomware attack has encrypted files on several servers. The incident response team has isolated the affected servers. What is the NEXT step in the containment, eradication, and recovery process?

   • ANotify the affected users and provide instructions.
   • BRestore the servers from backups immediately.
   • CIdentify the root cause and remove the ransomware from the environment.
   • DConduct a lessons-learned meeting to improve future response.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's intrusion detection system alerts on a workstation that is beaconing to a known command-and-control server. The workstation is used by an executive and contains sensitive documents. What is the FIRST step in the incident response process?

   • ANotify law enforcement about the potential breach.
   • BDisconnect the workstation from the network immediately.
   • CRebuild the workstation from a known-good image.
   • DVerify the alert and gather additional information to confirm the incident.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A forensic examiner receives a seized laptop from law enforcement. The examiner must create a forensic image without altering the original drive. Which procedure should the examiner follow?

   • ARemove the hard drive, connect it to a write-blocker, and acquire a bit-for-bit image while hashing the source and destination.
   • BUse a software tool to copy the drive while the laptop is running, then verify the copy with a checksum.
   • CCreate a compressed archive of the drive's contents and store it on a network share.
   • DBoot the laptop normally, log in, and copy all visible files to an external drive.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a high-severity incident that should be prioritized?

   • AA phishing email that was reported by a user and not clicked
   • BA malware infection on a single workstation that is isolated
   • CA ransomware attack that is encrypting files on a file server
   • DAn attempted brute-force attack on a user account that was locked out
   Reveal Solution Discussion Select an answer first