Incident Handling Process SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After eradicating a worm that infected several servers, the team has restored the servers from clean backups. Before declaring the incident resolved, what should the team do?

   • AMonitor the servers for a period to ensure the worm does not reappear.
   • BDelete the backups used for restoration.
   • CConduct a lessons-learned review before monitoring.
   • DImmediately reconnect the servers to the production network.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During which phase of the incident handling process does the CSIRT focus on removing the root cause and eliminating all traces of the incident from the environment?

   • AEradication
   • BContainment
   • CLessons Learned
   • DRecovery
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of forming a CSIRT during the Preparation phase?

   • ATo have a trained team ready to respond to security incidents
   • BTo conduct forensic analysis after an incident has occurred
   • CTo develop security awareness training for employees
   • DTo monitor network traffic for suspicious activity
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which activity is typically performed during the Recovery phase?

   • ADeleting malware from the affected systems
   • BMonitoring systems for any signs of reinfection
   • CDisconnecting the affected systems from the network
   • DConducting a post-incident review
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   During the Identification phase, what is the purpose of conducting an initial assessment of a potential incident?

   • ATo restore affected systems to their normal state
   • BTo immediately contain the threat and prevent further spread
   • CTo determine whether the event is a true incident and assess its scope and impact
   • DTo permanently delete all data related to the event
   Reveal Solution Discussion Select an answer first