Handling and Responding to Web Application Security Incidents ECIH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   During a web application incident, the incident handler decides to isolate the affected web server from the network. What is the primary purpose of this containment action?

   • ATo improve the server's performance.
   • BTo prevent the attacker from accessing the server and to stop further spread.
   • CTo comply with data retention policies.
   • DTo allow the server to cool down and prevent hardware failure.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has just resolved a web application incident where an attacker exploited a vulnerability in a third-party plugin. The incident handler is now writing the post-incident report. What is the MOST important element to include in the report to help prevent future incidents?

   • AThe total cost of the incident and the hours spent by the response team.
   • BThe root cause analysis and specific recommendations to patch or replace the vulnerable plugin.
   • CThe exact IP addresses of the attacker and the timeline of the attack.
   • DThe names of the employees who were involved in the response.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A mid-sized e-commerce company operates two web applications: a public product catalog that generates $50,000 in daily revenue and an internal employee portal used by 200 staff. The security team detects that the product catalog is being probed with directory traversal attempts, and the employee portal is showing signs of a brute-force attack on admin accounts. The product catalog has no sensitive data, while the employee portal contains HR records. Which incident should be prioritized first?

   • ANeither incident, because both are still in the probing stage and have not yet resulted in a confirmed breach.
   • BThe product catalog, because it generates significant revenue and any downtime directly impacts the business.
   • CThe employee portal, because it contains sensitive HR data and a successful brute-force attack could lead to a data breach.
   • DBoth incidents equally, because any security incident requires the same level of immediate response.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   During the post-incident analysis of a web application breach, the incident response team identifies that the WAF rules were not updated for six months. What is the most appropriate action to take based on this lesson learned?

   • ADelete the WAF logs to avoid evidence of negligence.
   • BIgnore the finding because the incident is already contained.
   • CDocument the finding and recommend a process to regularly update WAF rules.
   • DImmediately fire the employee responsible for WAF maintenance.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A web application is under an active attack that is exploiting a zero-day vulnerability. The incident handler must contain the incident, but the application is critical to business operations and cannot be taken offline for more than 15 minutes. Which containment strategy is the MOST appropriate?

   • ADisconnect the application from the network and investigate offline.
   • BShut down the application server and restore from backup.
   • CApply a virtual patch using a WAF to block the exploit pattern.
   • DChange all application credentials and restart the service.
   Reveal Solution Discussion Select an answer first