Incident Handling and Response Process ECIH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After a security incident, a company's incident response team is writing the final report. The report will be shared with senior management. Which type of information is MOST appropriate to include in the executive summary?

   • AA list of all the security tools used during the incident.
   • BTechnical details of the malware and its command-and-control infrastructure.
   • CA high-level overview of the incident, its impact, and the actions taken to resolve it.
   • DThe names of the employees who were involved in the incident.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is establishing an incident response team. The team will include members from IT, legal, public relations, and human resources. Which role is MOST important to define in the incident response plan?

   • AThe human resources representative, who will handle employee communications.
   • BThe incident commander, who has overall authority and responsibility for the response.
   • CThe public relations representative, who will manage media inquiries.
   • DThe legal counsel, who will handle all communication with law enforcement.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A university's IT team discovers that a phishing email with a malicious attachment was opened by several students and staff. The malware is a remote access trojan (RAT) that allows attackers to control the infected machines. The team needs to contain the incident to prevent further compromise. Which action is MOST appropriate?

   • ABlock the RAT's command-and-control server at the firewall and use endpoint detection and response (EDR) to kill the RAT process on the infected machines.
   • BWait for the RAT to be detected by the antivirus software and then clean the infected machines.
   • CDisable the infected machines' network access and reimage them from a known good image.
   • DIsolate all infected machines from the network and image them for forensics.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst at a cloud service provider notices a sudden spike in failed login attempts to a customer's virtual machines, followed by a successful login from an unusual IP address. The customer's environment is multi-tenant and the provider has access to hypervisor logs but not the guest OS. Which action is MOST appropriate for the analyst to take?

   • ANotify the customer and provide the relevant logs for their own investigation.
   • BReset the password for the customer's virtual machine account.
   • CTake a snapshot of the virtual machine for forensic analysis.
   • DImmediately block the unusual IP address at the network level.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is developing its incident response plan. The plan must define how the team will communicate during an incident. Which element is MOST important to include in the communication plan?

   • AA requirement to notify the media within one hour of any incident.
   • BA list of all employees' personal phone numbers.
   • CA designated incident commander and an alternate, with clear authority to make decisions.
   • DA policy that all communication must be done via email.
   Reveal Solution Discussion Select an answer first