Handling and Responding to Malware Incidents ECIH Practice Questions (Page 12)

Questions 56–57

1. 56expert · hard

   During a malware incident, the incident response team needs to collect forensic evidence from a compromised server. The server is still running and the malware is active in memory. The team wants to preserve volatile data and also capture the malware for analysis. Which sequence of actions is MOST appropriate?

   • APower off the server, then take a disk image
   • BIsolate the server first, then capture memory and disk image
   • CRun antivirus to remove the malware, then collect evidence
   • DCapture memory first, then take a disk image, then isolate the server
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A security operations center (SOC) receives an alert from an endpoint detection and response (EDR) tool indicating that a workstation has executed a PowerShell script that downloaded a binary from an external IP address. The binary is unsigned and has never been seen before. Which triage action should the analyst take FIRST?

   • ARun a full antivirus scan on the workstation
   • BCheck the reputation of the external IP address
   • CIsolate the workstation from the network
   • DDisable the user's account
   Reveal Solution Discussion Select an answer first