Incident Response Process CSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company uses a cloud-based infrastructure-as-a-service (IaaS) environment. A critical VM is compromised with ransomware. The company needs to restore service quickly, but also wants to preserve evidence for investigation. The VM is part of an auto-scaling group. What is the best approach?

   • AKeep the compromised VM running and attempt to remove the ransomware manually.
   • BLet the auto-scaling group terminate the compromised VM and rely on the latest AMI to launch a new instance.
   • CDetach the compromised VM from the auto-scaling group, take a snapshot for evidence, and launch a clean replacement VM.
   • DRestore the compromised VM from its latest snapshot and continue operations.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which action is essential for preserving the integrity of digital evidence during an incident response?

   • ACopying files to a shared network drive
   • BRunning antivirus scans on the evidence
   • CCreating a cryptographic hash of the evidence
   • DCompressing the evidence to save space
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An analyst is analyzing a memory dump from a compromised Linux server. The analyst suspects a rootkit is hiding processes. Which technique would be MOST effective in detecting the hidden processes?

   • AUse the ps command on the live system to list processes
   • BCheck the /proc filesystem on the live system
   • CCompare the process list from the memory dump with the process list from the live system
   • DSearch the memory dump for process names using strings
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During an incident response, an analyst needs to collect a forensic image of a compromised server's hard drive. The server is still running and the analyst wants to preserve evidence for potential legal action. Which action best preserves the integrity of the evidence?

   • ACopy all files from the hard drive to a network share using the operating system's copy command.
   • BBoot the server from a forensic live CD and create a bit-for-bit image of the hard drive to an external evidence drive.
   • CPower off the server immediately and then remove the hard drive for imaging.
   • DRun a checksum on the hard drive and then use the server's backup software to create a backup.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A SOC team is overwhelmed with alerts and needs to implement a triage process. The team wants to prioritize incidents based on potential impact and urgency. Which approach is most effective?

   • APrioritize incidents that are easiest to resolve to reduce the queue quickly.
   • BAssign equal priority to all incidents to avoid bias.
   • CPrioritize incidents based on the criticality of the affected asset and the indicators of compromise.
   • DHandle alerts in the order they are received to ensure fairness.
   Reveal Solution Discussion Select an answer first