Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   During the post-incident review, the team identifies that the incident was caused by a delayed patch deployment. What is the MOST effective way to implement the lesson learned?

   • ADocument the incident and close the case.
   • BRevise the patch management policy to include a shorter patch deployment timeline for critical vulnerabilities.
   • CPurchase additional antivirus licenses.
   • DIncrease the number of security staff.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An incident handler is documenting a data breach that involved multiple endpoints. The legal team requires a report that can be used in court. The report must include a timeline of events, evidence collected, and actions taken. What is the MOST important consideration when writing the report?

   • AWrite the report as quickly as possible to meet the deadline.
   • BEnsure the report is factual, objective, and includes the chain of custody for all evidence.
   • CInclude the names of all employees involved in the incident.
   • DUse technical jargon to demonstrate expertise.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An incident responder needs to collect evidence from an endpoint in a forensically sound manner. Which action is most important to preserve the integrity of the evidence?

   • ACreate a cryptographic hash of the evidence before and after collection
   • BStore evidence on the same hard drive as the original
   • CUse the endpoint's normal administrative tools to copy files
   • DCollect evidence only after the system is rebooted
   Reveal Solution Discussion Select an answer first
5. 19expert · hard · select all that apply

   You are responding to an insider threat incident on a laptop. You must collect evidence while the laptop is still running. Which of the following actions are appropriate for preserving volatile evidence? (Select all that apply.)

   • APower off the laptop immediately to preserve the hard drive.
   • BRecord active network connections and open files.
   • CCapture the contents of RAM using a memory acquisition tool.
   • DTake a photograph of the screen showing running processes.
   Check answers Discussion Select an answer first
6. 20expert · hard · select all that apply

   An incident handler is collecting evidence from a compromised endpoint that is part of a legal investigation. The handler must ensure the evidence is preserved and admissible. Which of the following actions are appropriate? (Select all that apply.)

   • ADocument the chain of custody for every piece of evidence.
   • BCreate a cryptographic hash of the evidence immediately after collection.
   • CUse a write-blocker when creating a disk image.
   • DStore the evidence on the original endpoint until the investigation is complete.
   Check answers Discussion Select an answer first