Incident Response CCT Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   In the six-phase incident response lifecycle, what is the main goal of the 'lessons learned' phase?

   • ATo review the incident handling process and identify improvements
   • BTo identify the attacker's identity and motives
   • CTo collect and preserve evidence for legal proceedings
   • DTo restore affected systems to normal operation
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company wants to improve its ability to detect and respond to security incidents. Which initiative is MOST aligned with the preparation phase of incident response?

   • AImplementing an intrusion detection system (IDS)
   • BDeveloping and testing an incident response plan
   • CPurchasing cyber insurance
   • DConducting regular security awareness training for employees
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   During a forensic investigation, an analyst needs to collect evidence from a running server. The analyst must preserve the evidence for potential legal action. Which action is MOST appropriate?

   • ACollect volatile data first, then create a forensic image of the disk
   • BPower off the server immediately to prevent data alteration
   • CCopy the entire disk using standard file copy commands
   • DUse the server's built-in backup software to create a backup
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security analyst discovers that an employee's account has been used to access sensitive data from an unusual location at an odd time. What is the FIRST step the analyst should take according to standard incident response procedures?

   • ADisable the employee's account immediately
   • BRestore the system from a backup
   • CNotify law enforcement
   • DGather additional information to confirm whether the activity is legitimate or malicious
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   During a data breach investigation, an analyst collects a hard drive from a compromised server. Which practice is essential to maintain the chain of custody?

   • ADocument every person who handles the evidence and when
   • BStore the hard drive in a secure location accessible to all team members
   • CMake a copy of the hard drive and give the original to the system administrator
   • DErase the hard drive after analysis to protect sensitive data
   Reveal Solution Discussion Select an answer first