First Response ECIH Practice Questions (Page 10)

Questions 46–47

1. 46expert · hard

   A malware outbreak is spreading across multiple departments. The incident response team has identified the source as a single email attachment. Some departments are critical to business operations and cannot be taken offline. What is the BEST containment strategy?

   • ALet the malware run its course and then clean up after.
   • BDisconnect all affected systems from the network immediately.
   • CShut down the email server to prevent further spread.
   • DBlock the malicious email attachment at the email gateway and isolate only the infected systems.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company has a limited incident response budget and must choose between investing in better detection tools or more training for first responders. The company has experienced several incidents where evidence was accidentally destroyed by well-meaning employees. Which investment is more likely to improve first response effectiveness?

   • ABetter detection tools to identify incidents faster.
   • BMore powerful forensic analysis software.
   • CTraining for first responders on evidence preservation and containment procedures.
   • DAdditional network bandwidth to handle incident traffic.
   Reveal Solution Discussion Select an answer first