Incident Handling and Response Process ECIH Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company's incident response team is handling a malware outbreak that has infected several servers. The team has identified the malware and has a clean backup from before the infection. However, the backup is 48 hours old, and the team is unsure if the malware was present before the backup was taken. Which approach is MOST appropriate?

   • ADo not restore from the backup; instead, rebuild the servers from scratch.
   • BRestore from the backup and assume the malware is not present.
   • CRestore the backup and immediately apply security patches.
   • DAnalyze the backup for signs of the malware before restoring.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's SOC receives an alert about a potential malware infection on a laptop. The laptop is used by a remote employee who is currently traveling. The SOC has remote access tools to isolate the laptop, but the employee is in the middle of an important presentation to a client. Which action is MOST appropriate?

   • AAsk the employee to disconnect the laptop from the internet during the presentation.
   • BWait until the presentation is over and then isolate the laptop.
   • CIsolate the laptop immediately to prevent potential data loss.
   • DMonitor the laptop's activity while allowing the presentation to continue, and isolate if malicious activity is observed.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the incident handling and response process?

   • ATo systematically manage an incident from detection through recovery while minimizing impact and preventing recurrence
   • BTo identify the attacker and pursue legal action against them
   • CTo immediately disconnect all affected systems from the network
   • DTo document every action taken during the incident for regulatory compliance
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After a security incident, a company's incident response team holds a lessons-learned meeting. The team identifies that the incident was not detected quickly because the SIEM alerts were not tuned properly. Which action should the team take to improve future detection?

   • ATune the SIEM rules to reduce false positives and prioritize critical alerts.
   • BDisable the SIEM alerts that were not useful during the incident.
   • CReplace the SIEM with a different security monitoring tool.
   • DIncrease the number of SIEM alerts to catch more events.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A media company's SOC detects a suspicious process running on a video editing workstation. The process is using a significant amount of CPU and is communicating with an external IP address. The workstation is used by a video editor who is working on a critical project with a tight deadline. The incident handler needs to determine if this is a real incident and scope the impact. Which action is MOST appropriate?

   • AReboot the workstation to clear any malicious code from memory.
   • BReview the workstation's process list and check if the suspicious process is a known video editing tool or plugin.
   • CImmediately kill the suspicious process and block the external IP address.
   • DDisconnect the workstation from the network and perform a full forensic analysis.
   Reveal Solution Discussion Select an answer first