Handling and Responding to Network Security Incidents ECIH Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company has just contained and eradicated a network worm. The recovery plan must restore services while minimizing the risk of reinfection. Which recovery strategy is MOST appropriate?

   • ARestore systems in phases, starting with a small pilot group
   • BRestore all systems simultaneously to minimize downtime
   • CRestore systems from backups taken during the incident
   • DRestore systems only after all employees are trained on phishing awareness
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company has contained a network intrusion and identified the root cause as a compromised service account that was used to install a backdoor. The service account is used by a critical business application that cannot be taken offline. The incident handler must eradicate the threat without disrupting the application. What is the best approach?

   • AChange the password of the compromised service account and continue using it.
   • BDisable the compromised service account and create a new one with the same permissions, then update the application to use the new account.
   • CRebuild the application server from a clean image and restore data.
   • DRemove the backdoor and leave the service account in place.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company has a limited incident response team and is facing two incidents: (1) a ransomware infection on a file server that is not yet fully encrypted, and (2) a suspected data exfiltration from a database containing customer records. The ransomware is spreading slowly, while the data exfiltration appears to be ongoing. Which incident should be prioritized?

   • ANeither, because the team should wait for more information.
   • BThe data exfiltration, because it involves sensitive customer data and is ongoing.
   • CThe ransomware infection, because it can spread and cause widespread damage.
   • DBoth equally, because both are critical.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   During the eradication phase of a network incident, the incident response team identifies that a backdoor was installed on multiple systems. What is the most thorough eradication action for these systems?

   • ADeleting the backdoor executable files
   • BChanging all user passwords
   • CReimaging the affected systems from a trusted source
   • DDisabling the network ports used by the backdoor
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   After a network incident, the incident response team is conducting a post-mortem. Which activity is MOST important to include?

   • ADeleting all incident-related emails to reduce clutter
   • BImmediately implementing all possible security tools
   • CAssigning a single person to blame for the incident
   • DReviewing the timeline of events and identifying gaps in response
   Reveal Solution Discussion Select an answer first