Handling and Responding to Malware Incidents ECIH Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   After eradicating malware from a file server, the incident handler needs to restore the server to normal operation. The server hosts critical applications and data. Which step should be taken FIRST during the recovery phase?

   • ANotify users that the server is available.
   • BRestore the server from a clean backup taken before the infection.
   • CInstall the latest security patches.
   • DReconnect the server to the network immediately.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   During a malware investigation, the incident handler needs to collect evidence that will be admissible in court. The evidence includes a hard drive from an infected computer and network logs from the company's firewall. Which action is MOST important to ensure the evidence is legally sound?

   • AUse the most expensive forensic tools available.
   • BMake a copy of the evidence and analyze the copy.
   • CDocument the chain of custody for all evidence items.
   • DCollect evidence as quickly as possible.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   After a major malware incident, the incident response team is conducting a post-incident review. The team identifies that the malware was able to spread because the containment phase was delayed due to unclear escalation procedures. Which improvement would MOST directly address this gap?

   • ADevelop a clear escalation matrix that defines who to contact and when.
   • BPurchase more advanced antivirus software.
   • CIncrease the frequency of security awareness training.
   • DConduct more frequent backups.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   After a malware incident is contained and eradicated, the incident response team conducts a post-incident review. Which activity is MOST important to include in this review?

   • AReimaging all affected systems to ensure they are clean.
   • BDeleting all logs related to the incident to free up storage space.
   • CDocumenting the timeline of events and identifying gaps in the response process.
   • DPatching all systems to prevent future infections.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security analyst receives an unknown executable from a user who clicked a link in a phishing email. The analyst wants to determine the malware's behavior without risking the production network. Which approach is MOST appropriate?

   • ARun the executable in a sandboxed virtual machine with network monitoring and snapshot capability.
   • BExecute the executable directly on a non-critical production server.
   • CDisassemble the executable using a debugger on the analyst's workstation.
   • DUpload the executable to a public malware analysis service.
   Reveal Solution Discussion Select an answer first