Incident Handling and Response Process ECIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After a data breach, a company's incident response team completes the containment and eradication phases. The team is now preparing the post-incident report. Which element is MOST important to include in the report to support future prevention?

   • AThe names of the employees who were involved in the incident.
   • BThe total cost of the incident, including lost productivity and legal fees.
   • CA detailed timeline of the incident and the actions taken during each phase.
   • DThe root cause analysis and recommended improvements to policies, procedures, and controls.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A university's security team sees a spike in failed login attempts against the student portal from a single IP address, followed by a successful login from the same IP to an account that has never logged in before. The account is a service account used by a legacy on-premises application. The team needs to determine if this is a real incident before declaring it. Which action is MOST appropriate to confirm the incident and scope its impact?

   • AImmediately disable the service account and reset its password.
   • BBlock the source IP at the firewall for all inbound traffic.
   • CRestore the service account from the last known good backup.
   • DCheck the application's documentation to see if the source IP matches a known legitimate integration endpoint.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A mid-sized e-commerce company is building its incident response capability. The security team has limited staff and the company's leadership wants to minimize business disruption during a cyber incident. Which preparation activity is MOST effective in achieving this goal?

   • ADevelop and test an incident response plan that includes clear roles, escalation paths, and communication procedures.
   • BHire an external incident response firm to handle all future incidents.
   • CTrain all employees on how to respond to a security incident.
   • DPurchase additional security tools that automate incident detection and response.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which activity is part of the eradication phase?

   • AReviewing the incident response process for improvements
   • BRestoring systems from clean backups
   • CDisconnecting affected systems from the network
   • DRemoving malware from affected systems
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary objective of the containment phase?

   • ATo identify the root cause of the incident
   • BTo limit the damage and prevent the incident from spreading further
   • CTo collect evidence for legal proceedings
   • DTo restore affected systems to normal operation
   Reveal Solution Discussion Select an answer first