Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After containing a network breach, the incident response team has identified the root cause as a vulnerable network service that was exploited. What is the MOST appropriate eradication step?

   • AIncrease logging on the network service
   • BApply the vendor security patch to the vulnerable service
   • CRestore the system from a backup taken before the breach
   • DDisable the network service permanently
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security operations center (SOC) analyst sees a network alert indicating a host is beaconing to a known malicious domain. The host is a domain controller that also runs a critical legacy application. The analyst must decide on containment. What is the BEST action?

   • AShut down the domain controller to preserve evidence
   • BIsolate the domain controller from the network immediately
   • CTake a memory image of the host before any action
   • DBlock the malicious domain at the DNS level
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has just eradicated a malware infection from its network. Before restoring full production traffic, what is the MOST critical recovery step?

   • ANotify all employees that the incident is resolved
   • BDelete all logs from the affected systems
   • CValidate that all systems are clean and patched
   • DReconnect all systems to the network simultaneously
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   After a network incident has been contained and eradicated, the incident response team must restore the affected systems to normal operation. Which action is part of the recovery phase?

   • ACollecting forensic evidence
   • BRestoring data from verified backups
   • CConducting a root cause analysis
   • DBlocking the attacker's IP address
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a network incident, the incident handler is collecting evidence from multiple systems. What is the BEST practice for documenting the evidence?

   • AStore evidence only in the incident handler's memory
   • BShare evidence details with all employees immediately
   • CWait until the incident is over to document everything
   • DRecord the date, time, and hash values of each piece of evidence
   Reveal Solution Discussion Select an answer first