Incident Handling and Response Process ECIH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the main goal of the preparation phase in incident handling?

   • ATo detect all security incidents as soon as they happen
   • BTo collect evidence for legal proceedings
   • CTo eliminate all vulnerabilities in the organization's systems
   • DTo ensure the organization is ready to respond effectively when an incident occurs
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A university's IT team notices that several student accounts are sending phishing emails. The accounts were accessed from IP addresses in different countries within a short time. The team suspects a credential-stuffing attack. Which action is MOST appropriate to confirm and scope the incident?

   • ASend a warning email to all students to change their passwords.
   • BReview authentication logs for the affected accounts and correlate with other accounts that show similar login patterns.
   • CDisable the affected accounts immediately and reset their passwords.
   • DBlock the IP addresses observed in the logs at the firewall.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   After a data breach at a retail company, the incident response team completed the containment, eradication, and recovery phases. The team is now in the post-incident activity phase. The company's management wants to know what went wrong and how to prevent similar incidents. Which activity is MOST important to perform during this phase?

   • AImmediately implement a new security tool that was recommended during the incident.
   • BDelete all logs and evidence related to the incident to free up storage space.
   • CConduct a lessons-learned meeting with all stakeholders involved in the incident.
   • DRestore all systems from the last known good backup.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is typically performed during the post-incident activity phase?

   • AConducting a lessons-learned meeting
   • BIsolating affected systems from the network
   • CAnalyzing logs to confirm the incident
   • DDeleting malware from affected systems
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After a ransomware incident, a hospital's IT team successfully restored systems from backups and resumed normal operations. During the post-incident review, the team discovers that the initial detection was delayed by 72 hours because the antivirus alerts were configured to notify only the help desk, who did not know how to escalate them. The incident response plan did not include a clear escalation path. Which post-incident activity is MOST important to perform to prevent a recurrence of this specific issue?

   • AUpdate the incident response plan to include a formal escalation procedure from the help desk to the security team.
   • BDisable antivirus alerts that are not directly sent to the security operations center.
   • CReplace the antivirus software with a more advanced endpoint detection and response (EDR) tool.
   • DConduct a full re-imaging of all workstations to ensure no malware remains.
   Reveal Solution Discussion Select an answer first