A company has experienced a ransomware attack that has encrypted files on several servers. The incident response team is activated. Which step should be taken FIRST?

Isolate the affected servers from the network

Pay the ransom to recover the files

Rebuild the servers from backups

A network administrator is configuring a new firewall and wants to allow inbound HTTPS traffic to a web server while blocking all other inbound traffic. Which rule should be created?

Allow TCP port 443 to the web server's IP address

Allow TCP port 80 to the web server's IP address

Allow all traffic to the web server's IP address

Allow UDP port 443 to the web server's IP address

A company's finance department frequently handles sensitive client data. To reduce the risk of lateral movement if a workstation is compromised, the security team wants to isolate the finance workstations from the rest of the corporate network while still allowing them to reach the internet and the finance file server. Which approach best meets this requirement?

Deploy an IPS in front of the finance file server to detect and block any suspicious traffic from the workstations.

Place the finance workstations in a separate VLAN with a firewall rule that permits only traffic to the finance file server and denies all other inter-VLAN traffic.

Install a host-based firewall on each finance workstation and configure it to block all inbound traffic from other subnets.

Use a VPN to connect the finance workstations directly to the file server, bypassing the corporate network.

A company's network monitoring system alerts that a server is sending a large volume of SYN packets to multiple external hosts. The server is not a legitimate SYN source. What is the FIRST step in the incident response process?

Isolate the server from the network

Rebuild the server from a known good image

EC-CouncilAssociate C|CISO

Domain 4Objective 3

Network Security ACCISO Practice Questions (Page 4)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 16–20

16expert · hard
A company has experienced a ransomware attack that has encrypted files on several servers. The incident response team is activated. Which step should be taken FIRST?
Select an answer first
17application · medium
A network administrator is configuring a new firewall and wants to allow inbound HTTPS traffic to a web server while blocking all other inbound traffic. Which rule should be created?
Select an answer first
18foundation · easy
In the OSI model, which layer is responsible for routing packets across different networks using logical addresses?
Select an answer first
19application · medium
A company's finance department frequently handles sensitive client data. To reduce the risk of lateral movement if a workstation is compromised, the security team wants to isolate the finance workstations from the rest of the corporate network while still allowing them to reach the internet and the finance file server. Which approach best meets this requirement?
Select an answer first
20application · medium
A company's network monitoring system alerts that a server is sending a large volume of SYN packets to multiple external hosts. The server is not a legitimate SYN source. What is the FIRST step in the incident response process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Network Security ACCISO Practice Questions (Page 4)

Questions 16–20

A company has experienced a ransomware attack that has encrypted files on several servers. The incident response team is activated. Which step should be taken FIRST?

A network administrator is configuring a new firewall and wants to allow inbound HTTPS traffic to a web server while blocking all other inbound traffic. Which rule should be created?

In the OSI model, which layer is responsible for routing packets across different networks using logical addresses?

A company's network monitoring system alerts that a server is sending a large volume of SYN packets to multiple external hosts. The server is not a legitimate SYN source. What is the FIRST step in the incident response process?

Keep studying — Information Security Core Competencies