First Response ECIH Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An incident responder is documenting their actions during an incident. Which of the following should be included in the documentation?

   • AOnly the actions that were successful.
   • BEvery action taken, including timestamps and the person responsible.
   • COnly the final summary of the incident.
   • DOnly the actions that involved evidence collection.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An incident responder has confirmed a malware infection on a user's computer. The user is a senior executive. According to the incident response plan, what should the responder do?

   • AHandle the incident quietly to avoid embarrassment to the executive.
   • BFollow the same escalation procedures as for any other user.
   • CImmediately inform the executive's assistant.
   • DWait for the executive to return before taking any action.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company's incident response plan states that first responders should focus on 'preservation of evidence' and 'containment'. An employee reports a possible virus on their computer. What is the FIRST action the first responder should take?

   • ARun a full antivirus scan on the computer.
   • BCopy all files to a USB drive for backup.
   • CAsk the employee to stop using the computer immediately.
   • DReboot the computer to clear the virus.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the recommended method for preserving non-volatile evidence from a compromised system?

   • ACopying only the files that appear suspicious
   • BCreating a bit-for-bit forensic image of the storage media
   • CBrowsing the files to identify important data
   • DRunning a disk cleanup utility to remove temporary files
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A system administrator notices that a database server's CPU usage is consistently high and that multiple failed login attempts have been logged from an unfamiliar IP address. Which indicator most strongly suggests a security incident?

   • AHigh CPU usage on the database server.
   • BFailed login attempts from an unfamiliar IP address.
   • CThe server has been up for 30 days without a reboot.
   • DThe server's time zone is set to UTC.
   Reveal Solution Discussion Select an answer first