A SOC analyst is investigating a server that was compromised. The analyst has a memory dump and a disk image. The analyst wants to determine if a specific file was accessed by the attacker. Which approach is most effective?

Only analyze the memory dump for the file's name.

Rebuild the server and check if the file is still present.

Analyze the memory dump for evidence of the file being opened, and analyze the disk image for file access artifacts.

Only analyze the disk image for the file's presence.

A SOC analyst is reconstructing the timeline of a multi-stage attack. The analyst has logs from the firewall, the authentication server, and the endpoint detection and response (EDR) tool. The logs have different timestamp formats and time zones. Which action is most important for accurate timeline reconstruction?

Normalize all timestamps to a common time zone and format before correlating events.

Use the EDR logs exclusively because they have the most detailed timestamps.

Ignore the timestamps and focus on the sequence of events as reported by each tool.

Use the timestamps as they are and correlate events by IP address only.

What is the primary purpose of correlating logs from multiple sources during incident response?

To encrypt log data for secure transmission

To automatically block malicious IP addresses

To reduce the volume of logs stored

To reconstruct the sequence of events leading to the incident

After a major security incident, the incident response team is conducting a post-incident review. The team has identified several areas for improvement. Which action is MOST important to ensure the improvements are implemented?

Assign ownership and deadlines for each improvement item

Document the improvements in the incident report

Add the improvements to the SOC's standard operating procedures

Share the improvements with all employees

EC-CouncilCertified SOC Analyst

Domain 6Objective 1

Incident Response Process CSA Practice Questions (Page 5)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

56questions here

12free pages

9concepts

Questions 21–25

21expert · hard
A SOC analyst is investigating a server that was compromised. The analyst has a memory dump and a disk image. The analyst wants to determine if a specific file was accessed by the attacker. Which approach is most effective?
Select an answer first
22foundation · easy
Which disk artifact is commonly examined to identify recently accessed files and folders on a Windows system?
Select an answer first
23expert · hard
A SOC analyst is reconstructing the timeline of a multi-stage attack. The analyst has logs from the firewall, the authentication server, and the endpoint detection and response (EDR) tool. The logs have different timestamp formats and time zones. Which action is most important for accurate timeline reconstruction?
Select an answer first
24foundation · easy
What is the primary purpose of correlating logs from multiple sources during incident response?
Select an answer first
25expert · hard
After a major security incident, the incident response team is conducting a post-incident review. The team has identified several areas for improvement. Which action is MOST important to ensure the improvements are implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Incident Response Process CSA Practice Questions (Page 5)

Questions 21–25

A SOC analyst is investigating a server that was compromised. The analyst has a memory dump and a disk image. The analyst wants to determine if a specific file was accessed by the attacker. Which approach is most effective?

Which disk artifact is commonly examined to identify recently accessed files and folders on a Windows system?

What is the primary purpose of correlating logs from multiple sources during incident response?

After a major security incident, the incident response team is conducting a post-incident review. The team has identified several areas for improvement. Which action is MOST important to ensure the improvements are implemented?

Keep studying — Incident Response, Forensics and Cloud SOC