Incident Response CCT Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company's web server is compromised and is serving malicious content. The incident response team needs to take the server offline for investigation, but the server also hosts the company's public website, which is critical for business. What is the BEST action?

   • ATake the server offline, preserve evidence, and bring up a clean backup server.
   • BRedirect traffic to a static maintenance page while investigating.
   • CImmediately wipe the server and reinstall the OS.
   • DLeave the server online to avoid business disruption.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A financial firm experiences a ransomware attack on its file server. The incident response team is activated. The CEO demands that the systems be restored immediately to minimize business disruption. The lead investigator insists on preserving evidence for potential legal action. The file server contains critical financial data. What is the BEST course of action?

   • AImmediately restore from backups without preserving evidence.
   • BKeep the server offline and do not restore until the investigation is complete.
   • CIsolate the file server, create a forensic image, and then restore from backups.
   • DPay the ransom to get the decryption key.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A hospital's IT team detects ransomware encrypting files on a single nurse's workstation. The workstation is on the same network segment as the pharmacy system, which is critical for patient care. The incident response team is assembling. What should be the FIRST containment action?

   • AShut down the pharmacy system to protect it.
   • BRun a full antivirus scan on the workstation.
   • CDisconnect the nurse's workstation from the network immediately.
   • DReboot the workstation to stop the ransomware process.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An incident responder is called to a compromised server. The responder needs to collect evidence for potential legal action. What is the MOST important principle to follow when collecting evidence?

   • APreserve the original evidence without altering it.
   • BCollect as much data as possible, even if it means changing system state.
   • CUse the fastest method to collect evidence.
   • DOnly collect evidence that is easy to access.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company experiences two incidents simultaneously: a phishing email that was reported and not clicked, and a ransomware attack that is actively encrypting files on the file server. Which incident should be prioritized?

   • AThe phishing email, because it could lead to a data breach.
   • BBoth equally, because both are security incidents.
   • CThe ransomware attack, because it is actively causing damage and has high impact.
   • DThe phishing email, because it was reported first.
   Reveal Solution Discussion Select an answer first