A company has confirmed that a workstation is infected with a worm that is spreading to other systems via network shares. The incident response team has isolated the infected workstation. What is the next step in the incident response process?

Conduct a lessons-learned review to improve future response.

Eradicate the malware by running an antivirus scan on the infected workstation.

Recover the system from a known-good backup.

Contain the spread by blocking SMB traffic on the network and patching the vulnerability.

In incident response, what is the primary goal of the containment phase?

To restore systems to normal operation

To gather evidence for legal proceedings

To remove the root cause of the incident

To limit the damage and prevent the attack from spreading further

An employee receives an email that appears to be from the company's IT department, asking them to click a link and enter their domain password to 'verify their account'. The link points to a look-alike login page. The employee enters their credentials, and later the attacker uses those credentials to access the corporate VPN. Which combination of attack categories best describes this incident?

Web application and DDoS attack

Social engineering and access attack

What is the primary difference between an IDS and an IPS?

An IDS uses signatures, while an IPS uses only anomaly detection

An IDS is a hardware device, while an IPS is software

An IDS detects and alerts, while an IPS can also block or prevent attacks

An IDS is placed inline, while an IPS is placed out-of-band

EC-CouncilCertified Network Defender

Domain 1Objective 1

Network Attacks and Defense Strategies CND Practice Questions (Page 10)

Part of the Network Security Fundamentals and Defense Strategy domain, which makes up ~16% of our current practice bank.

53questions here

11free pages

12concepts

Questions 46–50

46application · medium
A company has confirmed that a workstation is infected with a worm that is spreading to other systems via network shares. The incident response team has isolated the infected workstation. What is the next step in the incident response process?
Select an answer first
47foundation · easy
In incident response, what is the primary goal of the containment phase?
Select an answer first
48application · medium
An employee receives an email that appears to be from the company's IT department, asking them to click a link and enter their domain password to 'verify their account'. The link points to a look-alike login page. The employee enters their credentials, and later the attacker uses those credentials to access the corporate VPN. Which combination of attack categories best describes this incident?
Select an answer first
49foundation · easy
What is the primary difference between an IDS and an IPS?
Select an answer first
50foundation · easy
A security analyst is categorizing a set of observed network events. Which category would a port scan that maps open services on a target host fall under?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Network Attacks and Defense Strategies CND Practice Questions (Page 10)

Questions 46–50

A company has confirmed that a workstation is infected with a worm that is spreading to other systems via network shares. The incident response team has isolated the infected workstation. What is the next step in the incident response process?

In incident response, what is the primary goal of the containment phase?

What is the primary difference between an IDS and an IPS?

A security analyst is categorizing a set of observed network events. Which category would a port scan that maps open services on a target host fall under?

Keep studying — Network Security Fundamentals and Defense Strategy