What is the primary purpose of a post-incident review meeting?

To immediately restore all systems without documentation

To delete all evidence related to the incident

To assign blame to individuals for the incident

To identify lessons learned and improve future incident response

After containing a ransomware incident, the SOC team needs to eradicate the threat and recover systems. Which action is most appropriate for eradication?

Disconnect all systems from the network and leave them offline indefinitely.

Restore all systems from backups immediately without further analysis.

Change all user passwords and enable multi-factor authentication.

Identify and remove the root cause, such as the initial access vector and any persistence mechanisms.

An incident responder is collecting evidence from a compromised server. The responder needs to maintain chain of custody for legal proceedings. The responder has already imaged the disk and captured memory. What is the NEXT step?

Document the evidence with a hash, timestamp, and the name of the person who collected it

Store the evidence in a secure location without documentation

Analyze the evidence immediately to identify the attacker

Share the evidence with the legal team for review

EC-CouncilCertified SOC Analyst

Domain 6Objective 1

Incident Response Process CSA Practice Questions (Page 3)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

56questions here

12free pages

9concepts

Questions 11–15

11foundation · easy
Which type of analysis is most useful for detecting malware that exists only in a system's RAM and leaves no trace on the disk?
Select an answer first
12foundation · easy
What is the primary purpose of a post-incident review meeting?
Select an answer first
13foundation · easy
Which log source would provide the most direct evidence of an attacker attempting to authenticate to a server?
Select an answer first
14application · medium
After containing a ransomware incident, the SOC team needs to eradicate the threat and recover systems. Which action is most appropriate for eradication?
Select an answer first
15expert · hard
An incident responder is collecting evidence from a compromised server. The responder needs to maintain chain of custody for legal proceedings. The responder has already imaged the disk and captured memory. What is the NEXT step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Incident Response Process CSA Practice Questions (Page 3)

Questions 11–15

Which type of analysis is most useful for detecting malware that exists only in a system's RAM and leaves no trace on the disk?

What is the primary purpose of a post-incident review meeting?

Which log source would provide the most direct evidence of an attacker attempting to authenticate to a server?

After containing a ransomware incident, the SOC team needs to eradicate the threat and recover systems. Which action is most appropriate for eradication?

An incident responder is collecting evidence from a compromised server. The responder needs to maintain chain of custody for legal proceedings. The responder has already imaged the disk and captured memory. What is the NEXT step?

Keep studying — Incident Response, Forensics and Cloud SOC