Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An incident responder is documenting an endpoint security incident. Which information is essential to include in the incident report for legal purposes?

   • APersonal opinions of the responders
   • BThe names of all employees in the organization
   • COnly the final resolution summary
   • DTimeline of events and actions taken
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A malware infection has been contained on a critical database server. The malware is a rootkit that has modified kernel modules. The server is running a legacy application that is difficult to reinstall. The incident handler must eradicate the malware while minimizing downtime. What is the BEST approach?

   • ARestore the server from a known-good backup taken before the infection.
   • BKeep the server isolated and continue monitoring.
   • CManually remove the malicious kernel modules and clean the file system.
   • DRun a rootkit removal tool and then reboot.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An endpoint has been identified as communicating with a known malicious IP address. The system is a critical file server that cannot be taken offline during business hours. Which containment strategy balances the need to stop the communication while maintaining availability?

   • ADisconnect the server from the network immediately.
   • BIgnore the communication and monitor the server for further activity.
   • CBlock the malicious IP address at the firewall and isolate the endpoint on a separate VLAN.
   • DPower off the server until the investigation is complete.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   After containing an endpoint incident, the response team must remove all malicious artifacts from the affected system. Which activity is part of the eradication phase?

   • ANotifying law enforcement
   • BDeleting malicious files and registry entries
   • CCollecting memory dumps
   • DDisconnecting the system from the network
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During routine monitoring, a security analyst notices that a user's workstation has been sending large volumes of data to an external IP address at 3:00 AM. The workstation also has a new scheduled task that runs a PowerShell script. Which classification best describes this endpoint security incident?

   • AUnauthorized access attempt
   • BPhishing attempt
   • CData exfiltration and persistence mechanism
   • DDenial of service attack
   Reveal Solution Discussion Select an answer first