Incident Handling and Response Process ECIH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial firm's SOC detects an alert from its EDR showing a single workstation making repeated outbound connections to a known malware C2 domain. The workstation's user is on the finance team and handles sensitive data. The SOC has not yet confirmed whether other hosts are affected. Which action should the incident handler take FIRST to support both scoping and containment?

   • ANotify the finance team manager and ask the user to disconnect the network cable.
   • BIsolate the workstation from the network while preserving forensic data.
   • CSearch the SIEM and EDR for other hosts with similar outbound connections to the same C2 domain.
   • DImmediately shut down the workstation to prevent further data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which activity is part of the detection and analysis phase?

   • APatching vulnerabilities on affected systems
   • BConducting a lessons-learned meeting
   • CMonitoring logs and network traffic for signs of suspicious activity
   • DRestoring data from backups
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A financial services company's SOC detects unusual outbound traffic from a database server to an IP address in a foreign country. The database contains customer financial records. The incident handler needs to confirm the incident and scope the impact. Which action is MOST appropriate?

   • ARestore the database server from the last known good backup.
   • BImmediately disconnect the database server from the network to stop the data exfiltration.
   • CBlock the foreign IP address at the firewall for all outbound traffic.
   • DReview the database server's logs to identify which data was accessed and when the exfiltration began.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A healthcare provider's network is infected with a worm that spreads through SMB shares. The worm has already infected 20 of 200 workstations. The incident handler needs to contain the worm to prevent further spread while keeping critical patient-care systems operational. The provider has a mix of modern Windows 10 machines and legacy Windows 7 machines that cannot be patched. Which containment strategy is MOST effective?

   • ADisconnect all 200 workstations from the network and reimage them one by one.
   • BApply the latest security patches to all Windows 7 machines.
   • CBlock SMB traffic (port 445) at the network firewall and isolate the 20 infected workstations.
   • DWait for the worm to run its course and then clean up the infected machines.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A startup company is building its incident response capability from scratch. The company has a small IT team and uses a cloud-based email service. The CEO wants to ensure that the team knows what to do when a phishing email is reported. Which activity is MOST important to include in the preparation phase?

   • AConduct a security awareness training session for all employees on how to spot phishing emails.
   • BCreate a documented incident response procedure that includes a step-by-step guide for handling reported phishing emails.
   • CPurchase a new email security gateway to filter phishing emails before they reach users.
   • DSet up a honeypot email account to attract phishing emails and analyze them.
   Reveal Solution Discussion Select an answer first