Handling and Responding to Web Application Security Incidents ECIH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a web application incident, an incident handler needs to preserve evidence from a compromised Linux web server. The server is still running and the application is live. Which action is the most forensically sound FIRST step for evidence collection?

   • ACapture a memory dump and record the current time and system state.
   • BPower off the server immediately to prevent further tampering.
   • CCopy the entire hard disk using a standard file copy command.
   • DRun the application's built-in diagnostic tool to collect logs.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security operations center (SOC) is monitoring multiple web applications for a large organization. The SOC receives two alerts simultaneously: (1) a potential SQL injection attempt on a public-facing marketing website, and (2) a potential data exfiltration from an internal HR application. The marketing website is publicly accessible and generates revenue, while the HR application contains sensitive employee data. The SOC has limited resources and must prioritize one incident. Which incident should be prioritized?

   • ABoth incidents equally, because both are security incidents that require immediate attention.
   • BThe data exfiltration from the HR application, because it involves sensitive employee data and indicates an active breach.
   • CThe SQL injection attempt on the marketing website, because it is publicly accessible and could damage the organization's reputation.
   • DThe SQL injection attempt, because it may be a precursor to a larger attack on the organization.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An incident handler is triaging two web incidents: (1) a public-facing marketing site is defaced, and (2) an internal HR application is showing signs of data exfiltration. The company has a legal obligation to report data breaches within 72 hours. The marketing site has no sensitive data, but the HR application contains employee PII. Which incident should be prioritized?

   • ABoth incidents equally, because all incidents require immediate attention.
   • BThe marketing site, because it is easier to contain and restore quickly.
   • CThe HR application, because it involves potential data exfiltration of PII and triggers regulatory reporting requirements.
   • DThe marketing site, because defacement is visible to customers and damages brand reputation.
   Reveal Solution Discussion Select an answer first
5. 34expert · medium

   A web application is experiencing a high rate of 404 errors and the server logs show requests for paths like '/admin', '/backup', and '/.git'. The application does not have these paths. The incident handler is called. What is the MOST likely classification of this incident?

   • AA directory brute-force attack attempting to discover hidden directories or files.
   • BA cross-site scripting (XSS) attack attempting to inject scripts into the application.
   • CA denial-of-service (DoS) attack overwhelming the server with requests.
   • DA SQL injection attack targeting the application's database.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A post-incident review is being conducted after a web application breach. The team identifies that the incident response plan was not followed because the on-call handler was unfamiliar with the plan. What is the MOST effective lesson learned to implement?

   • AUpdate the incident response plan to be shorter and simpler.
   • BConduct regular incident response tabletop exercises and training for all team members.
   • CReplace the on-call handler with a more experienced team member.
   • DDocument the incident in the post-incident report and close the case.
   Reveal Solution Discussion Select an answer first