Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After a network intrusion, the incident handler has contained the affected systems and collected forensic evidence. The handler has identified the root cause as a vulnerable web application that was exploited. What should the handler do to eradicate the root cause?

   • APatch the web application and verify that no malicious files remain on the affected systems.
   • BChange all passwords and enable multi-factor authentication.
   • CRebuild the web server from a clean image and restore data from backups.
   • DDisconnect the web server from the network and leave it offline.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a network incident, the incident handler uses a tool to capture network traffic and saves the capture file. What documentation step is essential to ensure the evidence is admissible in court?

   • APrint the capture file and file it in a physical folder.
   • BEmail the capture file to the legal team for review.
   • CSave the capture file to a USB drive and keep it in a desk drawer.
   • DRecord the hash value of the capture file and document the chain of custody.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network monitoring system alerts on multiple failed SSH login attempts from a single external IP address to several internal servers. The attempts are increasing in frequency. What is the MOST appropriate immediate response?

   • AChange all internal server passwords immediately
   • BBlock the external IP address at the perimeter firewall
   • CIgnore the alert as it is likely a misconfiguration
   • DDisable SSH on all internal servers
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident response team is handling a network breach. The team lead needs to update the IT department and the executive team. What is the BEST way to handle these communications?

   • AWait for the post-mortem to communicate anything
   • BCommunicate only with the IT department
   • CSend separate updates tailored to each audience
   • DSend the same detailed technical update to both groups
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After containing a network intrusion, the incident handler has identified a backdoor user account and a scheduled task that re-establishes the backdoor. The handler has already isolated the affected server. What should the handler do next to eradicate the threat?

   • ADelete the backdoor account and remove the scheduled task, then verify no other persistence mechanisms exist.
   • BChange the passwords of all user accounts on the server.
   • CRebuild the server from a known-good backup immediately.
   • DDisconnect the server from the network and leave it isolated indefinitely.
   Reveal Solution Discussion Select an answer first