Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   After a major incident, the incident response team is writing the final report. The report will be shared with senior management and the legal team. The team wants to include lessons learned. What is the BEST way to present the lessons learned in the report?

   • AList specific, actionable recommendations with assigned owners and timelines.
   • BDescribe the technical details of the attack in depth.
   • CKeep the lessons learned vague to avoid legal liability.
   • DBlame the employees who clicked on the phishing email.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company's endpoint detection and response (EDR) tool has flagged a workstation with a known banking trojan. The workstation belongs to the CFO, who is about to present financial results to the board in 30 minutes. The trojan is actively communicating with a C2 server and has stolen credentials. The CFO's presentation files are stored locally on the workstation. What is the BEST course of action?

   • AKill the trojan process and continue monitoring.
   • BAllow the CFO to finish the presentation, then isolate the workstation.
   • CIsolate the workstation from the network immediately, then collect a memory dump and begin eradication.
   • DCopy the presentation files to a USB drive and then isolate the workstation.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A laptop is infected with malware that is attempting to spread to other systems via the network. The laptop is currently in a hotel lobby using public Wi-Fi. What is the BEST immediate containment action?

   • AConnect the laptop to a wired network to get a better connection.
   • BRun a full antivirus scan while connected to the Wi-Fi.
   • CDisable the laptop's Wi-Fi and Ethernet adapters.
   • DTurn off the laptop and remove the battery.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team is investigating an incident where a user's endpoint is exhibiting unusual behavior: the mouse moves on its own, and files are being deleted. The endpoint is connected to a corporate network with sensitive data. The user is not present. What is the BEST immediate action?

   • ADisconnect the endpoint from the network and preserve the current state.
   • BReboot the endpoint to stop the unusual behavior.
   • CLog into the endpoint remotely and kill suspicious processes.
   • DWait for the user to return to confirm the behavior.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A workstation is infected with a worm that spreads via SMB. The worm has been detected, and the system has been isolated. What is the NEXT step in the eradication phase?

   • APatch the SMB vulnerability and remove the worm from the system.
   • BNotify the users that the system is safe to use.
   • CReconnect the system to the network to test if the worm is gone.
   • DDisable the SMB service permanently on the workstation.
   Reveal Solution Discussion Select an answer first