What is the primary responsibility of the communications liaison in an incident response team?

To perform forensic analysis of compromised systems

To manage communication with stakeholders, including management, legal, and public relations

To collect and preserve digital evidence

To make final decisions on containment strategies

What is a common output of a lessons-learned meeting?

A public statement about the incident

A list of employees to terminate

An action plan to update security controls and procedures

A security analyst is investigating a possible breach. The firewall logs show outbound connections from an internal server to an external IP on port 443 at 2:00 AM. The DNS logs show a query for a domain that resolves to that IP. The server's authentication logs show a successful logon with a service account at 1:55 AM. Which conclusion is best supported by correlating these logs?

The firewall logs are false positives because the connection used port 443, which is allowed.

The server was compromised and the service account was used to initiate a command-and-control connection.

The external IP is a legitimate update server and the connection is routine maintenance.

The DNS query proves the domain is malicious and the server is infected.

EC-CouncilCertified Network Defender

Domain 6Objective 1

Incident Response and Forensics Investigation CND Practice Questions (Page 2)

Part of the Incident Response, Forensics and Continuity domain, which makes up ~13% of our current practice bank.

66questions here

14free pages

15concepts

15 Concepts in This Objective

Incident Response Fundamentals
Incident Response Phases
Incident Response Team Roles
Incident Classification and Triage
Evidence Collection and Preservation
Forensic Imaging and Duplication
Forensic Analysis Techniques
Log Analysis and Correlation
Memory and Volatile Data Analysis
Network Forensics
Malware Analysis Basics
Forensic Reporting and Documentation
Legal and Ethical Considerations
Incident Recovery and Remediation
Lessons Learned and Post-Incident Review

Questions 6–10

6foundation · easy
What is the primary responsibility of the communications liaison in an incident response team?
Select an answer first
7foundation · easy
What is a common output of a lessons-learned meeting?
Select an answer first
8application · medium
A security analyst is investigating a possible breach. The firewall logs show outbound connections from an internal server to an external IP on port 443 at 2:00 AM. The DNS logs show a query for a domain that resolves to that IP. The server's authentication logs show a successful logon with a service account at 1:55 AM. Which conclusion is best supported by correlating these logs?
Select an answer first
9foundation · easy
Which incident response team role is primarily responsible for making final decisions and coordinating the overall response effort?
Select an answer first
10foundation · easy
Which log source would be most useful for detecting unauthorized access attempts to a web server?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Incident Response and Forensics Investigation CND Practice Questions (Page 2)

Questions 6–10

What is the primary responsibility of the communications liaison in an incident response team?

What is a common output of a lessons-learned meeting?

Which incident response team role is primarily responsible for making final decisions and coordinating the overall response effort?

Which log source would be most useful for detecting unauthorized access attempts to a web server?

Keep studying — Incident Response, Forensics and Continuity