Incident Handling and Response Process ECIH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   After a ransomware incident, a hospital's IT team restored file servers from backups and confirmed that the malware was removed from all endpoints. The hospital's CIO wants to resume normal operations as quickly as possible. Which additional step is MOST critical before declaring recovery complete?

   • AVerify that restored data is intact and that systems function correctly in the production environment.
   • BSchedule a lessons-learned meeting for the following week.
   • CImmediately reconnect all restored systems to the internet to update antivirus definitions.
   • DNotify the hospital's insurance provider and begin the claims process.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the main purpose of the post-incident activity phase?

   • ATo contain the incident and prevent further damage
   • BTo detect new incidents that may have occurred
   • CTo review the incident and identify lessons learned to improve future response
   • DTo restore systems to their normal operational state
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A small business has a part-time IT administrator and no dedicated security staff. The owner wants to establish an incident response capability without hiring full-time security personnel. Which approach is MOST practical?

   • ADevelop a simple incident response plan and contract with a managed security service provider (MSSP) for 24/7 monitoring and response.
   • BTrain the IT administrator to perform all incident response activities in-house.
   • CRely on the IT administrator to handle incidents as they arise without a formal plan.
   • DPurchase an expensive enterprise SIEM and hire a security analyst to manage it.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the purpose of analyzing indicators during the detection and analysis phase?

   • ATo restore normal operations as quickly as possible
   • BTo permanently remove the threat from affected systems
   • CTo confirm whether an incident has occurred and determine its scope
   • DTo prepare the incident response team's roles and responsibilities
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A government contractor's SOC detects a suspicious PowerShell script running on a server in the research department. The script is downloading a file from an external IP address. The server is not internet-facing and is protected by a firewall that only allows outbound traffic on port 443. The incident handler needs to determine if this is a real incident and scope the impact. Which action is MOST appropriate?

   • AReboot the server to clear any malicious code from memory.
   • BDisconnect the server from the network and perform a full forensic analysis.
   • CImmediately block the external IP address at the firewall and isolate the server.
   • DReview the server's recent command history and check if the PowerShell script is a known administrative task.
   Reveal Solution Discussion Select an answer first