Introduction to Incident Handling and Response ECIH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A hospital's IT team detects two incidents at the same time: (1) a ransomware infection on a single administrative workstation, and (2) a suspected malware infection on a server that manages patient vital signs. Both are confirmed. Which incident should the team prioritize?

   • AThe patient vital signs server because it affects patient safety and critical operations.
   • BBoth equally because all incidents are important.
   • CThe administrative workstation because it is easier to contain.
   • DThe workstation first because ransomware is always more severe.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which role in an incident response team is primarily responsible for coordinating the overall response effort and making final decisions?

   • ASecurity Analyst
   • BIncident Manager
   • CIT Support Staff
   • DCommunication Lead
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst identifies a suspicious process running on a critical production server. The process is not in the approved software list and is communicating with an external IP address. According to the incident handling phases, what should the analyst do first?

   • AReboot the server to terminate the suspicious process.
   • BPerform identification by gathering more information about the process and its behavior to confirm whether it is malicious.
   • CImmediately disconnect the server from the network to contain the potential threat.
   • DReport the finding to management and wait for instructions.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A regional bank's security operations center detects a ransomware outbreak on a file server that hosts loan applications. The incident manager must decide the immediate response. The file server is not yet fully encrypted, and the bank's core banking system is unaffected. What is the most appropriate first action according to the incident handling phases?

   • AImmediately restore the file server from the last backup without further analysis.
   • BDisconnect the file server from the network to contain the spread while preserving volatile evidence.
   • CNotify the public relations team before taking any technical action.
   • DReboot the file server to clear the ransomware from memory and restore normal operations quickly.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is developing an incident response plan. The plan needs to define the steps to take during an incident, including who to contact and what tools to use. What is the BEST way to structure this information?

   • ACreate separate playbooks for different types of incidents.
   • BUse a generic checklist that applies to all incidents.
   • CKeep the plan high-level and let responders decide on the spot.
   • DInclude all details in a single, comprehensive document.
   Reveal Solution Discussion Select an answer first