Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   During a network incident, a security team identifies that a specific server is communicating with a known malicious IP address. Which containment action is the most immediate and targeted?

   • AReimaging the server
   • BDisabling the server's network interface
   • CBlocking the malicious IP address at the firewall
   • DShutting down the entire network
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is responding to a network breach that may involve customer data. The incident handler needs to communicate with stakeholders. Which communication approach is most appropriate?

   • AWait until the investigation is complete before communicating anything.
   • BProvide detailed technical information to all employees to keep them informed.
   • CTailor communication to each stakeholder group, sharing necessary information without exposing sensitive details.
   • DCommunicate only with law enforcement and avoid internal communication.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   During the recovery phase of a network incident, the incident response team has restored the affected servers from backups. What is the next critical step to ensure the systems are safe to return to production?

   • ANotifying the users that the systems are back online
   • BDisabling the firewall rules that were added during containment
   • CDeleting the backups used for restoration
   • DVerifying that the systems are free of malware and vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   After a network incident, the incident handler is writing the post-mortem report. What should be included to ensure the report is useful for improving future response?

   • AOnly the technical details of the attack, such as IP addresses and malware hashes.
   • BA timeline of events, root cause analysis, and a list of action items with owners and deadlines.
   • CA list of employees who were involved and their performance evaluations.
   • DA summary of the incident that omits any failures to avoid embarrassment.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization has three simultaneous network incidents: (1) a malware infection on a single non-critical workstation, (2) a suspected ransomware encryption on a file server containing critical business data, and (3) a phishing email reported by one user. Which incident should be triaged as the HIGHEST priority?

   • AThe ransomware incident on the file server
   • BAll incidents should be handled simultaneously
   • CThe phishing email reported by one user
   • DThe malware infection on the workstation
   Reveal Solution Discussion Select an answer first