Handling and Responding to Web Application Security Incidents ECIH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application is compromised by a ransomware attack that encrypted the application's configuration files. The incident handler needs to contain the incident while preserving the ability to investigate. Which containment action is the most appropriate?

   • ADisconnect the web server from the network but keep it powered on.
   • BRestore the configuration files from backup immediately.
   • CPay the ransom to regain access to the files.
   • DImmediately shut down the web server and all connected systems.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After a web application incident has been fully resolved, the incident response team is conducting a post-incident review. The team identifies that the incident was not detected for 72 hours because the monitoring system was not configured to alert on the specific attack pattern. What is the MOST important lesson learned to include in the report?

   • AThe incident response team should have checked the logs manually more frequently.
   • BThe monitoring system needs to be updated with new detection rules for the attack pattern that was missed.
   • CThe web application should have been taken offline immediately after the attack was suspected.
   • DThe attacker should have been identified earlier through threat intelligence sharing.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard · select all that apply

   An incident handler is collecting evidence from a web application server that was compromised. The server is running a Linux operating system, and the incident handler needs to preserve evidence in a forensically sound manner. Which of the following actions should the incident handler take? (Select all that apply.)

   • ARun the 'chkdsk' command to check the integrity of the file system.
   • BPower off the server immediately to prevent the attacker from destroying evidence.
   • CCapture the contents of the server's memory using a forensic memory acquisition tool.
   • DRecord the current date and time of the server and note any discrepancies with the actual time.
   • ECreate a bit-for-bit copy of the server's hard drive using a forensic imaging tool.
   Check answers Discussion Select an answer first
5. 14application · medium

   A web application has been compromised, and the incident response team has confirmed that an attacker exploited a vulnerability in a third-party plugin to upload a web shell. The web shell is actively being used to execute commands on the server. Which containment strategy should be implemented FIRST?

   • AChange all application and database passwords to prevent unauthorized access.
   • BApply a firewall rule to block the attacker's IP address.
   • CDelete the web shell file from the server and update the plugin to the latest version.
   • DDisconnect the server from the network to immediately stop the attacker's access.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During triage, an incident handler discovers that a web application vulnerability is being exploited to access a database containing personal data of customers. Which factor should be given the most weight when determining the priority of this incident?

   • AThe potential impact on customer privacy and regulatory compliance.
   • BThe age of the web server hardware.
   • CThe number of lines of code in the web application.
   • DThe number of employees in the IT department.
   Reveal Solution Discussion Select an answer first