Countermeasures Across Hacking Phases EHE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is investigating a server that was compromised. The attacker installed a rootkit that hides processes and files. The team needs to determine the extent of the compromise and preserve evidence for legal action. Which approach is the most appropriate?

   • AReboot the server and then run a full antivirus scan.
   • BCreate a forensic image of the server's memory and disk, then analyze the image on a separate forensic workstation.
   • CRun a rootkit removal tool on the live server to clean the system.
   • DDisconnect the server from the network and leave it powered on for manual inspection.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has a legacy application that requires an outdated version of a third-party library. The library has a known remote code execution vulnerability, but the vendor no longer provides patches. The application is critical to operations and cannot be taken offline. Which countermeasure is the most effective to prevent an attacker from exploiting this vulnerability to gain access?

   • ADisable the vulnerable library's logging to reduce the attack surface.
   • BIncrease the application's memory allocation to prevent buffer overflow attacks.
   • CChange the application's service account to a standard user account.
   • DPlace the application behind a web application firewall (WAF) and restrict network access to only the required users.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is planning to deploy a new web application. The security team wants to minimize the information that an attacker can gather during the reconnaissance phase. Which of the following is the most effective countermeasure?

   • ARemove version numbers from HTTP headers and error pages.
   • BImplement a web application firewall (WAF) to block malicious requests.
   • CEnable HTTPS to encrypt all traffic between the client and server.
   • DUse a load balancer to distribute traffic across multiple servers.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During the covering tracks phase, which countermeasure is most effective?

   • ANetwork segmentation
   • BPatch management
   • CMulti-factor authentication
   • DCentralized logging with log integrity checks
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does a firewall help mitigate reconnaissance activities?

   • ABy blocking or filtering probes and queries from external sources
   • BBy providing strong authentication for remote users
   • CBy encrypting all data stored on the network
   • DBy detecting and removing malware from infected systems
   Reveal Solution Discussion Select an answer first