Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   During a post-incident review, the team identifies that the incident was not detected quickly because the monitoring tools lacked proper alerting rules. What should be the primary outcome of this finding?

   • AImplementing new alerting rules and updating the monitoring procedures
   • BFiring the security analyst who missed the alert
   • CIncreasing the number of security tools
   • DDocumenting the finding in the incident report and taking no further action
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After a network intrusion, the incident response team has identified a backdoor account created by the attacker. What is the MOST effective eradication step?

   • AChange the password of the backdoor account
   • BDisable and remove the backdoor account
   • CDocument the backdoor account in the incident report
   • DMonitor the backdoor account for future activity
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A large organization experiences unusual network behavior: several internal hosts are sending large volumes of traffic to a single external IP on port 443, and the traffic pattern is periodic. The hosts are part of a research department that handles sensitive data. The incident handler must determine whether this is a security incident or legitimate activity. Which approach is most appropriate?

   • AImmediately isolate all affected hosts to prevent data exfiltration.
   • BAnalyze the traffic patterns and correlate with known indicators of compromise before deciding.
   • CIgnore the traffic because it is on port 443, which is commonly used for legitimate HTTPS.
   • DBlock the external IP at the firewall and continue monitoring.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization is responding to a significant network breach. The incident commander needs to communicate status to executive leadership. What is the MOST appropriate communication approach?

   • AWait until the incident is fully resolved before communicating
   • BCommunicate only to the legal department
   • CProvide concise, high-level updates on impact and actions
   • DShare detailed technical logs with the executives
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   After a network incident has been resolved, the incident response team is conducting a post-mortem. What is the PRIMARY goal of this review?

   • AImmediately re-deploy the same systems without changes
   • BDelete all incident documentation to protect privacy
   • CIdentify lessons learned and improve future response
   • DAssign blame to the responsible employee
   Reveal Solution Discussion Select an answer first