Handling and Responding to Web Application Security Incidents ECIH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A post-incident review is being conducted after a web application breach. The incident response team successfully contained and eradicated the incident, but the review reveals that the team did not have a clear escalation path, leading to delays in involving senior management. The team also lacked a predefined communication plan for notifying affected customers. Which of the following improvements should be prioritized in the post-incident report?

   • AIncrease the number of security staff to ensure faster response times in future incidents.
   • BDevelop a formal incident response plan that includes clear escalation procedures and a communication plan.
   • CImplement a more advanced intrusion detection system to detect incidents earlier.
   • DConduct more frequent security awareness training for all employees.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   After containing a web application incident, the incident handler must eradicate the root cause. Which action is an example of eradication?

   • ANotifying customers about the incident.
   • BMonitoring the network for further malicious activity.
   • CRestoring the web application from a clean backup.
   • DPatching the vulnerable web application component that was exploited.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A web application incident handler is triaging two incidents: Incident A involves a publicly accessible customer-facing portal that is defaced, and Incident B involves an internal admin panel that is slow but still functional. Which incident should be prioritized first?

   • AIncident B, because the internal panel is critical for administrative operations.
   • BIncident A, because it affects a public-facing system and has a higher business impact.
   • CBoth incidents should be handled simultaneously because they are equally severe.
   • DIncident B, because it is an internal system and therefore more sensitive.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A web application's login page is returning 'Account Locked' errors for many users, and the application logs show a high number of failed login attempts from a single IP range. The incident handler is called. What is the most likely classification of this incident?

   • AA session hijacking attack stealing active user sessions.
   • BA distributed denial-of-service (DDoS) attack targeting the login page.
   • CA SQL injection attack exploiting the login form.
   • DA brute-force attack attempting to guess user credentials.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is investigating an incident where a web application's search functionality is returning results from other users' accounts. The application logs show that the search queries contain URL-encoded characters and the application is using a shared database connection pool. The analyst suspects an insecure direct object reference (IDOR) vulnerability. The application is critical to the business, and the team needs to contain the incident while minimizing downtime. Which of the following actions is the MOST effective initial containment measure?

   • AMonitor the search functionality for further suspicious activity without taking any immediate action.
   • BDisable the search functionality temporarily to prevent further unauthorized data access.
   • CTake the entire web application offline to prevent any further data leakage.
   • DRevoke database access for the application's service account to prevent further queries.
   Reveal Solution Discussion Select an answer first