Incident Handling and Response Process ECIH Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A manufacturing company's SOC detects unusual outbound traffic from a workstation in the finance department to a known command-and-control domain. The workstation is a domain-joined Windows machine used by a single accountant. The incident handler needs to stop the immediate threat while preserving the ability to perform forensic analysis and maintain business continuity. The accountant is in the middle of a critical month-end close. Which action should the incident handler take FIRST?

   • ADisconnect the workstation from the network and image the hard drive.
   • BBlock the C2 domain at the firewall and continue monitoring the workstation.
   • CIsolate the workstation by disabling its switch port and notify the accountant.
   • DReboot the workstation to clear any malware from memory.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A regional bank discovers that a phishing email with a malicious macro was opened by three employees in the mortgage department. The malware is a keylogger that sends data to an external server. The bank's compliance team requires that the mortgage department remain operational during business hours to meet regulatory service-level agreements. The incident handler must choose a containment strategy that balances the need to stop the data exfiltration with the need to keep the department functional. Which strategy is MOST appropriate?

   • ADisable the three user accounts and issue temporary accounts on spare workstations.
   • BBlock the external server's IP at the firewall and use endpoint detection and response (EDR) to kill the keylogger process on the three machines.
   • CIsolate all three workstations from the network immediately and image them for forensics.
   • DWait until after business hours to isolate the workstations and then perform forensic imaging.
   Reveal Solution Discussion Select an answer first
3. 38expert · hard

   A hospital's IT team discovers that a ransomware strain has encrypted files on several servers in the radiology department. The team has good backups, but restoring all servers will take several hours. The hospital's emergency department relies on the radiology system to view X-rays. Which containment strategy BEST balances patient safety and incident response?

   • ARestore the most critical server first and bring it back online while other servers remain isolated.
   • BImmediately shut down all affected servers to prevent further spread.
   • CIsolate the affected servers from the network but keep them powered on for forensic analysis.
   • DPay the ransom to get the decryption key and restore systems faster.
   Reveal Solution Discussion Select an answer first