Handling and Responding to Endpoint Security Incidents ECIH Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   After a data breach incident, the incident response team wants to improve future response efforts. Which activity is MOST aligned with the post-incident phase?

   • AReimaging all affected endpoints.
   • BUpdating the incident response plan based on lessons learned.
   • CResetting all user passwords.
   • DDeleting all logs related to the incident.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   You are collecting evidence from an infected endpoint for a potential legal case. Which of the following practices is ESSENTIAL to maintain the chain of custody?

   • AEncrypt the evidence and keep the encryption key with the evidence.
   • BDocument every person who handles the evidence and the time and purpose of each transfer.
   • CStore the evidence on the investigator's personal laptop.
   • DMake multiple copies of the evidence and distribute them to the incident response team.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   After an endpoint incident, the incident response team must produce a report for stakeholders. What is the primary purpose of this report?

   • ATo assign blame to specific individuals
   • BTo communicate the incident's impact and response actions
   • CTo serve as a marketing document
   • DTo provide a technical deep-dive for all employees
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A malware outbreak has infected 50 endpoints, but the organization cannot afford to reimage all of them immediately. The malware is known to be a fileless variant that resides in memory and uses PowerShell scripts. Which eradication strategy is MOST effective given the constraint of limited resources?

   • AReimage all 50 endpoints over the weekend.
   • BRun a standard antivirus scan on all endpoints.
   • CDisable PowerShell on all endpoints permanently.
   • DIsolate the infected endpoints, terminate malicious processes, and apply application whitelisting to prevent PowerShell execution.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   After containing a malware outbreak on several endpoints, you need to eradicate the threat and restore the systems. Which approach is MOST effective for ensuring the malware is completely removed?

   • ADelete the malicious files identified by the antivirus scan.
   • BReimage the affected endpoints from a known-good image and then apply security patches.
   • CRestore the system to a previous restore point.
   • DRun a disk cleanup utility to remove temporary files.
   Reveal Solution Discussion Select an answer first