Incident Handling and Response Process ECIH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A mid-sized law firm is creating its incident response plan. The firm has a small IT team of three people, none of whom are dedicated security staff. The partners want to ensure that when a security incident occurs, the right people are notified quickly and the firm's legal obligations regarding client data are met. Which element is MOST important to include in the preparation phase of the plan?

   • AA detailed log of all past security incidents and their resolutions.
   • BA backup schedule that specifies daily backups of all client data.
   • CA communication plan that identifies internal stakeholders, external counsel, and regulatory contacts.
   • DA list of pre-approved forensic imaging tools to use on compromised systems.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is investigating a potential data exfiltration incident. The analyst finds that a large amount of data was transferred to an external IP address over the past week. The analyst also notices that the source system is a file server that is scheduled for decommissioning next month. Which action is MOST appropriate?

   • ANotify the IT department to accelerate the decommissioning of the file server.
   • BAnalyze the file server's logs to determine which files were accessed and by whom.
   • CImmediately disconnect the file server from the network.
   • DIgnore the activity because the server is being decommissioned soon.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which activity is typically performed during the preparation phase of incident handling?

   • AIsolating affected systems to prevent further spread
   • BRestoring systems from backups after an attack
   • CIdentifying the root cause of a security breach
   • DEstablishing an incident response team and defining roles and responsibilities
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's security team notices that a user's account has been used to access sensitive files at unusual hours. The team suspects the account is compromised. Which action is MOST appropriate to confirm the suspicion?

   • AAsk the user if they accessed the files.
   • BReset the user's password and require multi-factor authentication.
   • CDisable the user's account immediately.
   • DReview the user's recent authentication logs and file access history for anomalies.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's incident response team has contained a malware infection and is now in the eradication phase. The team has removed the malware from all affected systems. Which additional action is MOST important during eradication?

   • ANotify all employees that the incident is over.
   • BDelete all backups that were made before the incident.
   • CReimage all systems, even those that were not affected.
   • DVerify that the malware has been completely removed from all systems.
   Reveal Solution Discussion Select an answer first