Incident Response Process CSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC analyst receives three alerts simultaneously: (1) a single workstation detected a known malware signature, (2) a domain admin account failed login 10 times in 5 minutes from a foreign IP, and (3) a database server is sending large outbound data volumes to an unknown IP. The analyst must prioritize. Which incident should be handled first?

   • AAll three equally, because triage should treat every alert with the same urgency.
   • BThe workstation malware detection, because it is a confirmed signature match.
   • CThe domain admin brute-force attempt, because it targets a high-privilege account.
   • DThe database server outbound data transfer, because it indicates possible data exfiltration in progress.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC team has confirmed that a worm is spreading across the internal network via an unpatched SMB vulnerability. The team needs to stop the spread while preserving evidence for analysis. Which action should be taken first?

   • AApply the SMB patch to all systems immediately.
   • BRebuild all infected systems from a clean image.
   • CIsolate infected systems from the network by disconnecting them or applying firewall rules.
   • DRun a full antivirus scan on all systems.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After a phishing incident that compromised several user accounts, the SOC team has completed containment and eradication. The incident manager is preparing the post-incident report. Which element is most important to include for improving future response?

   • AA timeline of the incident and a review of what worked and what did not.
   • BA detailed list of all employees who clicked the phishing link.
   • CThe names of the vendors whose products failed to block the phishing email.
   • DThe exact content of the phishing email for future reference.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   After a security incident is resolved, the incident response team is preparing the final report. Which element is MOST important to include to help prevent future incidents?

   • AThe names of the attackers if known
   • BThe root cause analysis and lessons learned
   • CThe list of affected systems and data
   • DA detailed timeline of the incident
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC analyst is analyzing a memory dump from a compromised server. The analyst wants to identify the malicious process and its associated network connections. Which technique is most effective?

   • ASearch the memory dump for strings using a text editor.
   • BRun the memory dump through an antivirus scanner.
   • CUse a memory forensics framework like Volatility to list processes and network connections.
   • DReboot the server and run a live malware scan.
   Reveal Solution Discussion Select an answer first