Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During a network incident, the incident handler is documenting actions taken. Which information is MOST critical to include in the documentation?

   • ATimestamps of all actions and the person responsible
   • BThe estimated cost of the incident
   • CThe brand of the affected hardware
   • DThe names of all employees in the company
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   A security operations center receives two incident reports: one about a phishing email that was quarantined before any user clicked the link, and another about a ransomware infection that has encrypted files on a file server. Which incident should be prioritized for immediate response?

   • AThe ransomware infection, because it has already caused impact
   • BThe phishing email, because it was reported first
   • CBoth equally, because both are security incidents
   • DNeither, because both are low-severity
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   After containing a malware infection on a server, the incident response team needs to remove the root cause and all malicious artifacts from the system. Which action is part of the eradication phase?

   • AIsolating the server from the network
   • BMonitoring the server for further activity
   • CRestoring the server from a backup
   • DDeleting the malicious files and registry entries
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A financial firm's SOC detects a sudden spike in outbound DNS queries from a single internal host to a known malware-related domain. The host is a non-critical file server used by the finance team. The incident handler must act quickly while minimizing business disruption. What should the handler do first?

   • AVerify the DNS queries are not caused by a legitimate application, then isolate the host if confirmed malicious.
   • BBlock the malicious domain at the firewall and continue monitoring the host.
   • CIsolate the file server from the network immediately.
   • DRebuild the file server from a known-good backup immediately.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is responding to a network incident that has been contained but not yet fully eradicated. The incident handler needs to update the executive team. What should the update include?

   • AA list of all affected IP addresses and system names.
   • BA detailed technical analysis of the malware and its propagation methods.
   • CA high-level summary of the incident, current status, and expected impact on operations.
   • DNo update until the incident is fully resolved.
   Reveal Solution Discussion Select an answer first