Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 11)

Questions 51–53

1. 51foundation · easy

   During an incident response, a security analyst takes notes about the actions performed, the time each action was taken, and the evidence collected. Why is this documentation important?

   • AIt replaces the need for forensic analysis
   • BIt provides a chronological record that can be used for legal proceedings and post-incident analysis
   • CIt is only required for incidents involving data breaches
   • DIt helps the attacker understand what was done
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company has fully eradicated a network worm from its environment. The affected servers have been cleaned and patched. What is the next step in the recovery process?

   • AConduct a post-mortem review before restoring any systems.
   • BReimage all servers again to ensure they are clean.
   • CDisconnect the servers from the network for an extended period.
   • DRestore the servers to production and monitor them closely for signs of reinfection.
   Reveal Solution Discussion Select an answer first
3. 53application · medium

   A SOC analyst is triaging three alerts: (1) a single workstation with a known malware signature, (2) a domain controller with failed login attempts, and (3) a web server with a high volume of 404 errors. Which alert should be prioritized as the most urgent?

   • AThe domain controller with failed login attempts, because it may indicate a brute-force attack on a critical system.
   • BThe web server with 404 errors, because it may indicate scanning.
   • CThe workstation with known malware, because it is a confirmed infection.
   • DAll alerts equally, because each requires investigation.
   Reveal Solution Discussion Select an answer first