An analyst is examining a forensic image of a compromised server. The analyst finds a suspicious script in the /tmp directory and a corresponding entry in the bash history. The script appears to download a payload from an external IP. Which forensic artifact would BEST help the analyst reconstruct the attack timeline?

The IP address of the external server

File system timestamps (MAC times) of the script and related files

The content of the script itself

The user account that owns the script

A small company has no formal incident response plan. A malware infection is spreading across the network. Which immediate action best aligns with incident response fundamentals?

Wait for a formal incident response plan to be written before acting.

Ignore the infection until business hours to avoid disrupting operations.

Shut down all systems to stop the spread, without documentation.

Assemble a small team to contain the infection and begin documenting actions.

A company has just contained a ransomware outbreak. The malware has been removed from all affected systems, and the systems have been restored from backups. What is the NEXT step in the incident response process?

Close the incident ticket and move on to other work

Monitor the network for any signs of recurrence

Conduct a lessons-learned review to identify improvements in the response process

Update the incident response plan based on the findings

What is the correct sequence of phases in the incident response lifecycle?

Containment, Detection, Preparation, Eradication, Recovery, Lessons Learned

Preparation, Detection, Eradication, Containment, Recovery, Lessons Learned

Detection, Preparation, Containment, Recovery, Eradication, Lessons Learned

Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned

What type of information can be obtained from analyzing a memory dump?

Deleted files from the hard drive

Running processes and network connections

Firewall configuration settings

EC-CouncilCertified Network Defender

Domain 6Objective 1

Incident Response and Forensics Investigation CND Practice Questions (Page 6)

Part of the Incident Response, Forensics and Continuity domain, which makes up ~13% of our current practice bank.

66questions here

14free pages

15concepts

15 Concepts in This Objective

Incident Response Fundamentals
Incident Response Phases
Incident Response Team Roles
Incident Classification and Triage
Evidence Collection and Preservation
Forensic Imaging and Duplication
Forensic Analysis Techniques
Log Analysis and Correlation
Memory and Volatile Data Analysis
Network Forensics
Malware Analysis Basics
Forensic Reporting and Documentation
Legal and Ethical Considerations
Incident Recovery and Remediation
Lessons Learned and Post-Incident Review

Questions 26–30

26application · medium
An analyst is examining a forensic image of a compromised server. The analyst finds a suspicious script in the /tmp directory and a corresponding entry in the bash history. The script appears to download a payload from an external IP. Which forensic artifact would BEST help the analyst reconstruct the attack timeline?
Select an answer first
27application · medium
A small company has no formal incident response plan. A malware infection is spreading across the network. Which immediate action best aligns with incident response fundamentals?
Select an answer first
28application · medium
A company has just contained a ransomware outbreak. The malware has been removed from all affected systems, and the systems have been restored from backups. What is the NEXT step in the incident response process?
Select an answer first
29foundation · easy
What is the correct sequence of phases in the incident response lifecycle?
Select an answer first
30foundation · easy
What type of information can be obtained from analyzing a memory dump?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.