Introduction to Incident Handling and Response ECIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An incident handler is investigating a suspected insider threat. The employee's manager wants to immediately view the employee's email and file access logs to confirm the suspicion. What is the most appropriate action for the incident handler?

   • AProvide the logs to the manager immediately to support the investigation.
   • BFollow the organization's incident handling policy and legal procedures for accessing employee data, and involve HR and legal counsel.
   • CCopy the logs to a personal USB drive and give them to the manager discreetly.
   • DRefuse to share any information with the manager because it is a legal matter.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   After a denial-of-service (DoS) attack was successfully mitigated, the incident response team is conducting a lessons-learned review. Which activity is most important to include in this review?

   • AAssigning blame to the team member who failed to prevent the attack.
   • BDeleting all logs from the attack to free up storage space.
   • CIdentifying what worked well and what did not, and updating the incident response plan accordingly.
   • DImmediately returning to normal operations without further discussion.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of an external party that may need to be communicated with during an incident?

   • AThe organization's internal IT help desk
   • BLaw enforcement agencies
   • CThe organization's legal department
   • DThe organization's executive board
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst has identified a potential incident: a user's workstation is showing signs of malware infection. The analyst is unsure whether it is a real incident or a false positive. What should the analyst do NEXT?

   • AReport the incident to law enforcement immediately.
   • BIgnore the alert because it is likely a false positive.
   • CImmediately disconnect the workstation from the network.
   • DInvestigate the alert to confirm whether it is a real incident.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's incident response team is activated during a data breach. The team includes a technical lead, a forensic analyst, a legal advisor, and a public relations specialist. The incident manager is responsible for coordinating the response. Which task is the PRIMARY responsibility of the incident manager?

   • AIsolating the affected systems from the network.
   • BMaking final decisions on response actions and coordinating the team.
   • CPerforming the forensic analysis of the compromised systems.
   • DDrafting the press release for external communication.
   Reveal Solution Discussion Select an answer first