Incident Handling Process SCE Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A SOC analyst receives an alert from the IDS about suspicious traffic to a known malicious IP address. The analyst checks the firewall logs and sees that the traffic originated from a single workstation. The workstation is used by the finance department. What should the analyst do to confirm the incident?

   • AReboot the workstation to clear any malicious processes.
   • BCheck the workstation's process list and network connections to see if malware is running.
   • CIgnore the alert because the finance department is trusted.
   • DImmediately block the workstation's network access.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   After a data breach, the incident response team has eradicated the malware and closed the vulnerability. They have restored the affected systems from backups and are ready to return them to production. However, the business wants to minimize downtime and is pressuring the team to reconnect the systems immediately. What should the team do?

   • AConduct a lessons-learned review before reconnecting the systems.
   • BReconnect the systems immediately to minimize downtime.
   • CValidate the systems are clean and monitor them for a period before full production use.
   • DReconnect the systems but only allow read-only access initially.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following correctly lists the six phases of the incident handling process in the order they are typically performed?

   • APreparation, Identification, Eradication, Containment, Recovery, Lessons Learned
   • BPreparation, Identification, Containment, Eradication, Recovery, Lessons Learned
   • CIdentification, Preparation, Containment, Eradication, Recovery, Lessons Learned
   • DPreparation, Identification, Containment, Recovery, Eradication, Lessons Learned
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the purpose of preserving evidence during incident handling?

   • ATo maintain the integrity of evidence for forensic analysis and legal proceedings
   • BTo prevent the attacker from deleting files
   • CTo automatically contain the incident
   • DTo speed up the incident response process
   Reveal Solution Discussion Select an answer first