Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A forensic investigator needs to preserve evidence from a live endpoint that is actively communicating with a command-and-control server. The endpoint is a domain controller and cannot be shut down. Which action BEST balances evidence preservation with containment?

   • ABlock the command-and-control IP and then capture a memory dump.
   • BPower off the domain controller and image the hard drive.
   • CCapture a memory dump and then block the command-and-control IP at the firewall.
   • DDisconnect the domain controller from the network immediately.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After a malware outbreak on several workstations, the incident response team has contained the affected endpoints and collected evidence. The team now needs to eradicate the malware and restore the systems. Which approach is the most reliable for ensuring the malware is completely removed?

   • AReimage the affected workstations from a known-good image and then apply security patches.
   • BRun an antivirus scan and quarantine detected files.
   • CDelete the malware files identified during the investigation.
   • DRestore the system to a previous restore point.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An endpoint security analyst discovers a file named 'invoice.exe' in the Downloads folder of a user's machine. The file has a high entropy score and is not signed. The user reports they did not download it. Which indicator of compromise (IOC) is most directly associated with this finding?

   • ARegistry key modification
   • BMalicious file presence
   • CNetwork connection to a command-and-control server
   • DUnusual user behavior
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During an investigation, you discover that the endpoint's hard drive is encrypted with BitLocker. You need to collect evidence, but you do not have the recovery key. What is the BEST course of action?

   • AObtain the BitLocker recovery key from Active Directory or the organization's key management system.
   • BDisable BitLocker on the endpoint.
   • CImage the hard drive without decryption.
   • DAttempt to brute-force the BitLocker password.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During an incident, the incident handler collects evidence from an endpoint, including memory dumps, disk images, and network logs. The case may go to court. What should the handler do to ensure the evidence is admissible?

   • AShare the evidence with the legal team before analysis.
   • BDocument the chain of custody and hash all collected evidence.
   • CKeep the evidence on the original endpoint until the trial.
   • DStore the evidence in a shared network folder for easy access.
   Reveal Solution Discussion Select an answer first