Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After resolving a security incident, the incident handler must produce a report for senior management. What is the MOST important element to include in this report?

   • AA timeline of the incident and the actions taken during each phase.
   • BThe personal opinions of the incident handler about the cause.
   • CThe exact malware source code.
   • DThe names of all employees involved in the incident.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst notices that a server's CPU usage is consistently high, and the network team reports large outbound data transfers during off-hours. The server is a file server with no legitimate reason for large outbound transfers. The analyst suspects a data exfiltration incident. What should the analyst do to confirm the incident while preserving evidence?

   • AReboot the server to clear the high CPU usage.
   • BCheck the server's event logs for login attempts.
   • CCapture network traffic and collect a memory dump from the server.
   • DImmediately block all outbound traffic from the server.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   After a phishing incident that compromised several endpoints, the post-incident review identifies that the organization lacks a centralized logging solution, making it difficult to correlate events across endpoints. The security team has a limited budget. What is the MOST effective improvement to address this gap?

   • AImplement a SIEM solution to aggregate and correlate logs from all endpoints.
   • BHire more security analysts.
   • CPurchase more endpoint antivirus licenses.
   • DIncrease the frequency of security awareness training.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A post-incident review reveals that the incident response team did not have a clear escalation path, which delayed the containment of a malware outbreak. What should be the primary outcome of the lessons learned?

   • AReplace the incident response team members.
   • BConduct a technical analysis of the malware.
   • CIncrease the number of security tools deployed.
   • DUpdate the incident response plan to include a clear escalation and communication procedure.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   During an endpoint incident, a security analyst needs to isolate an infected workstation from the network to prevent lateral movement. Which action is the most immediate and effective containment measure?

   • ADisable the network interface card (NIC) on the workstation
   • BRun a full antivirus scan
   • CChange the user's password
   • DReboot the workstation
   Reveal Solution Discussion Select an answer first