Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A user reports that their workstation suddenly became unresponsive, and the screen shows a ransomware note demanding payment. The endpoint protection agent has been disabled, and the system is still connected to the corporate network. As the incident handler, what is the FIRST action you should take to prevent further spread?

   • ACopy all files from the workstation to a network share for backup.
   • BRun a full antivirus scan on the workstation while it is still connected.
   • CReboot the workstation to clear the ransomware from memory.
   • DDisconnect the network cable and disable the wireless adapter on the affected workstation.
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A user reports that their computer is running slowly and the hard drive is almost full. The IT team finds thousands of files with random names in the user's profile folder. The files appear to be encrypted. What is the most likely classification of this endpoint incident?

   • AInsider data theft
   • BRansomware infection
   • CDenial of service attack
   • DHardware failure
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A user reports that their Windows workstation is sluggish and shows high CPU usage from a process named 'svchost.exe' running from a temp folder. The security team checks the endpoint and finds a scheduled task that downloads and executes a script from a remote IP. The process has made outbound connections to that IP. What should the incident handler do FIRST to contain the threat while preserving evidence?

   • ABlock the remote IP at the firewall and leave the endpoint running for monitoring.
   • BDisconnect the workstation from the network and take a memory image before killing the process.
   • CKill the malicious process immediately and then delete the scheduled task.
   • DReboot the endpoint to clear the malicious process from memory.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   During endpoint evidence collection, the responder must preserve volatile data. Which type of data is considered volatile and should be collected first?

   • AEmail archives
   • BContents of RAM
   • CFiles on the hard drive
   • DSystem logs stored on disk
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An endpoint is suspected of being compromised because it is running unusual processes and making outbound connections to a foreign IP address. Which of the following is the MOST reliable indicator of compromise (IOC) to confirm the incident?

   • AThe amount of free disk space.
   • BThe outbound connections to the foreign IP address.
   • CThe system's uptime.
   • DThe user's recent web browsing history.
   Reveal Solution Discussion Select an answer first