First Response ECIH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is the first response phase considered critical in the incident handling process?

   • AIt is the phase where the incident is officially declared
   • BIt is the phase where the incident response team is formed
   • CIt provides the only opportunity to collect volatile evidence
   • DIt determines the legal jurisdiction for the incident
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has a formal incident response plan. An incident is detected by the help desk. What is the FIRST step in the first response process?

   • AIdentify and verify that an incident has occurred.
   • BPreserve evidence for forensic analysis.
   • CEscalate the incident to management.
   • DContain the incident to prevent further damage.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A critical database server is showing signs of active malware activity, but it is also serving live customer transactions. The incident responder must balance containment with business continuity. Which action is MOST appropriate?

   • ADo nothing and monitor the server for further activity.
   • BIsolate the server at the network level while allowing only necessary traffic to continue.
   • CCapture a memory dump first, then disconnect the server.
   • DDisconnect the server from the network immediately to stop the malware.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A user reports that their computer is running slowly and the antivirus has been disabled. The incident responder checks the system and finds multiple unknown processes running. What is the MOST appropriate next step?

   • AImmediately re-enable the antivirus and run a full scan.
   • BCapture a memory dump and document the running processes.
   • CDisconnect the computer from the network and power it down.
   • DNotify the user that the issue is resolved and monitor the system.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An incident handler is responding to a suspected malware infection on a critical production server that cannot be taken offline for more than 10 minutes. The handler must preserve evidence while minimizing downtime. Which approach is most appropriate?

   • ACapture a memory dump and a logical image of critical files, then restore the server from a known-good backup.
   • BPerform a full forensic disk image before any other action.
   • CRun a live antivirus scan and clean the infection without capturing evidence.
   • DPower off the server and ship the hard drive to a forensic lab.
   Reveal Solution Discussion Select an answer first