Handling and Responding to Web Application Security Incidents ECIH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary goal of the recovery phase after a web application security incident?

   • ATo update the incident response plan.
   • BTo collect evidence for legal proceedings.
   • CTo restore the web application to normal operation in a secure state.
   • DTo identify the attacker's identity.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company's web application has been compromised by a ransomware attack that encrypted critical application files. The incident response team has isolated the affected servers from the network. The company has a backup strategy that includes daily backups stored on a separate network segment. The team needs to restore the application to a secure operational state. Which of the following actions should be taken FIRST during the recovery phase?

   • AAnalyze the ransomware to identify the encryption algorithm and attempt to decrypt the files without paying.
   • BPay the ransom to obtain the decryption key and decrypt the encrypted files.
   • CRestore the application from the most recent backup and then apply all security patches.
   • DRebuild the application from scratch using the original source code and configuration files.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When collecting evidence from a web application incident, which piece of information is most important to document to maintain the chain of custody?

   • AThe name and contact information of the person who collected the evidence.
   • BThe brand of the web server hardware.
   • CThe IP address of the attacker.
   • DThe hash value of the evidence files.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A web application has been defaced, and the incident response team has confirmed that the attacker exploited a vulnerability in the content management system (CMS). The team has isolated the server from the network. What is the NEXT step in the containment process?

   • ARebuild the server from a known-good backup and apply the latest CMS security patches.
   • BChange the CMS administrator password and monitor the server for further unauthorized access.
   • CRestore the defaced website content from the most recent backup without patching the CMS.
   • DAnalyze the defacement to determine the attacker's motives before taking further action.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An incident handler is responding to a web application breach that occurred on a cloud-hosted virtual machine. The organization's legal counsel has indicated that the evidence may be needed for litigation. The incident handler needs to collect evidence from the cloud VM, but the cloud provider's console shows that the VM is currently running and has been since the breach was detected. Which of the following actions is the MOST appropriate for preserving evidence?

   • ATake a snapshot of the VM's disk from the cloud provider's console, then capture the VM's memory using a remote forensic tool.
   • BCopy the VM's log files to a separate storage location and then delete the VM to prevent further compromise.
   • CRely on the cloud provider's built-in logging and monitoring data, as it is sufficient for legal proceedings.
   • DPower off the VM immediately to prevent the attacker from destroying evidence, then create a disk snapshot.
   Reveal Solution Discussion Select an answer first