Introduction to Incident Handling and Response ECIH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary responsibility of the communication lead in an incident response team?

   • ATo patch vulnerabilities in affected systems
   • BTo perform forensic analysis of affected systems
   • CTo manage the flow of information to stakeholders and external parties
   • DTo make final decisions on containment strategies
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the main purpose of a lessons-learned review after an incident?

   • ATo justify the cost of the incident response to management
   • BTo delete all records of the incident to protect the organization
   • CTo identify what went well and what can be improved in future responses
   • DTo assign blame to individuals who caused the incident
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst discovers that an employee's workstation was used to access unauthorized sensitive files. The analyst wants to preserve evidence for potential legal action. Which action best supports legal admissibility of the evidence?

   • ACreate a forensic image of the workstation's hard drive using a write-blocker and document the chain of custody.
   • BTake screenshots of the files and email them to the legal department.
   • CCopy the relevant files to a USB drive and store it in the manager's desk.
   • DRun a full antivirus scan on the workstation to ensure it is clean before collecting evidence.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After containing and eradicating a phishing attack that compromised several email accounts, the incident response team is conducting a lessons-learned review. What is the PRIMARY goal of this review?

   • ATo update the firewall rules to block the phishing domain.
   • BTo delete all evidence related to the incident to free up storage space.
   • CTo assign blame to the employees who clicked the phishing link.
   • DTo identify what worked well and what needs improvement in the response process.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company's incident response team is responding to a worm that is spreading across the network. The worm is actively infecting new systems. The team has identified the infection vector and has a patch available. However, applying the patch requires rebooting critical servers, which will cause downtime. The incident manager must decide the best course of action. What should the team do?

   • AContain the spread by isolating infected systems, then apply the patch to uninfected systems during a planned maintenance window.
   • BDo nothing until the worm has run its course, then clean up the affected systems.
   • CImmediately reboot and patch all critical servers, accepting the downtime to stop the worm.
   • DOnly patch the infected systems and leave uninfected systems unprotected.
   Reveal Solution Discussion Select an answer first