First Response ECIH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An incident handler has collected a forensic image of a compromised server. The image is stored on an external hard drive. What is the best practice for maintaining the chain of custody?

   • AMake multiple copies and distribute them to all team members.
   • BKeep the drive on the analyst's desk for easy access.
   • CEmail the image to the legal team for safekeeping.
   • DLabel the drive with a unique identifier and log every transfer of custody.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   During initial response, which of the following is a sign that a system may be compromised?

   • AThe system's disk space is 50% utilized
   • BThe system has been running for 30 days without a reboot
   • CNew user accounts have been created without authorization
   • DThe system's clock is set to the correct time
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An incident responder is assessing a potential data breach. The breach may involve sensitive customer data, but the extent is unknown. The responder must decide whether to escalate the incident. What is the MOST appropriate action?

   • AEscalate the incident immediately because of the potential severity.
   • BContain the incident first and then escalate.
   • CEscalate only if the data is confirmed to be customer data.
   • DWait until the full extent of the breach is known.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A server in a research lab is infected with ransomware that encrypts files on the local disk and attempts to spread to other servers. The incident handler must contain the threat while preserving evidence for investigation. Which action best meets both goals?

   • ADisconnect the server from the network but leave it powered on.
   • BRun a script to delete the ransomware executable from the disk.
   • CChange the server's IP address to a different subnet.
   • DPower off the server immediately to stop the encryption process.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network administrator sees a sudden spike in outbound traffic from a workstation at 3:00 AM. The workstation is normally unused at that time. Which action is most appropriate?

   • AIgnore it because the workstation is not used at night.
   • BTreat it as a potential indicator of compromise and investigate.
   • CReboot the workstation to clear the traffic.
   • DChange the workstation's IP address.
   Reveal Solution Discussion Select an answer first