Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator notices that a server is sending a large volume of traffic to an external IP address on port 445, and the server's CPU usage is unusually high. The administrator also sees that the server is attempting to connect to many internal IPs on the same port. What type of incident is most likely occurring?

   • AA misconfigured backup job.
   • BA worm or malware spreading across the network.
   • CA legitimate software update process.
   • DA DDoS attack targeting the server.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has eradicated a malware infection from its web servers. The servers were rebuilt from clean images and patched. Before returning them to production, what should the incident handler do to support recovery?

   • AImmediately reconnect the servers to production to minimize downtime.
   • BRestore the latest known-good backups and verify data integrity.
   • CReconnect the servers to the network and monitor them for a short period.
   • DValidate that the servers are clean, patched, and configured securely before reconnecting them to the network.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After a network incident is resolved, the incident handler is conducting a post-mortem review. What is the primary goal of this review?

   • AIdentify what went wrong and what went well to improve future incident response.
   • BImmediately implement all possible security improvements regardless of cost.
   • CDelete all incident documentation to protect the company from liability.
   • DAssign blame to the individuals who caused the incident.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst observes repeated failed login attempts from a single external IP address against the SSH service on a public-facing server. The attempts are spaced over several hours and target multiple usernames. Which type of network security incident does this pattern most likely indicate?

   • AMan-in-the-middle attack
   • BBrute-force attack
   • CARP spoofing
   • DSQL injection
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has contained and eradicated a network worm. The recovery plan includes restoring services. What is the BEST sequence for recovery?

   • ARestore systems in alphabetical order
   • BRestore systems only after all employees are notified
   • CRestore critical systems first, then less critical systems
   • DRestore all systems at once to save time
   Reveal Solution Discussion Select an answer first