Introduction to Incident Handling and Response ECIH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary goal of effective communication during an incident?

   • ATo ensure that the right information reaches the right people at the right time
   • BTo keep all information confidential from external parties
   • CTo share as much information as possible with everyone
   • DTo communicate only through email to maintain a record
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   During a ransomware incident, the incident response team discovers that the ransomware has encrypted files on a server that is subject to regulatory compliance. The legal team wants to preserve evidence for potential litigation, while the operations team wants to restore the server from backups as quickly as possible to minimize downtime. The incident manager must balance these conflicting needs. What is the most appropriate course of action?

   • APreserve forensic evidence from the server before restoration, then restore from backups while documenting the chain of custody.
   • BDelete the encrypted files to prevent further spread and restore from backups.
   • CRestore the server from backups immediately and skip evidence preservation to minimize downtime.
   • DKeep the server offline indefinitely until legal counsel completes a full investigation.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an incident investigation, an incident handler needs to collect evidence from a compromised server. What is the MOST important consideration when collecting evidence?

   • ACollecting only the evidence that is easy to access.
   • BPreserving the integrity of the evidence by using forensically sound methods.
   • CSharing the evidence with all team members immediately.
   • DCollecting evidence as quickly as possible, even if it means altering the system.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A small business has no formal incident response plan. After a malware infection, the owner wants to improve the company's ability to respond to future incidents. What is the MOST effective first step?

   • ADevelop an incident response policy and a set of procedures.
   • BPurchase more antivirus software licenses.
   • CBack up all data to the cloud.
   • DTrain all employees on how to respond to incidents.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has a mature incident response program. The security team is evaluating whether to invest in additional threat intelligence feeds. What is the MOST relevant benefit of threat intelligence for incident handling?

   • AIt guarantees that no incident will occur.
   • BIt eliminates the need for an incident response plan.
   • CIt reduces the need for employee training.
   • DIt helps identify potential threats and indicators of compromise more quickly.
   Reveal Solution Discussion Select an answer first