Incident Handling Process SCE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following activities is a key component of the Preparation phase in incident handling?

   • AIsolating affected systems to prevent further spread
   • BRestoring systems from clean backups
   • CDeploying security monitoring tools and establishing an incident response policy
   • DDeleting malware from infected hosts
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After a server compromise, the incident response team has isolated the server and identified the root cause as an unpatched vulnerability in a third-party application. The team has removed the attacker's backdoor. What should the team do next to complete the Eradication phase?

   • ARestore the server from a backup
   • BMonitor the server for unusual activity
   • CPatch the vulnerability in the third-party application
   • DDocument the incident in the CSIRT's ticketing system
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After a ransomware incident, the incident response team has removed the malware from all affected systems and closed the vulnerability that was exploited. Before returning the systems to production, what is the MOST important step to perform?

   • ARestore the systems from the last known good backup and immediately reconnect them to the network.
   • BConduct a lessons-learned review before restoring any systems.
   • CReimage all systems from the original vendor media to ensure no malware remains.
   • DValidate that the systems are clean and that the vulnerability is actually closed, then monitor them after reconnecting.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is establishing a new CSIRT and wants to be prepared for future security incidents. Which activity is most aligned with the Preparation phase?

   • AIsolating a compromised server from the network
   • BDeploying endpoint detection and response (EDR) agents to all endpoints
   • CConducting a forensic analysis of a previous breach
   • DPatching a critical vulnerability in a web application
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During an incident, a SOC analyst takes a memory dump of a compromised server and then isolates the server from the network. The analyst records the time, date, and hash of the memory dump in the incident log. Why is this documentation practice important?

   • AIt reduces the need for containment
   • BIt preserves the chain of custody for potential legal proceedings
   • CIt prevents the attacker from returning
   • DIt speeds up the eradication phase
   Reveal Solution Discussion Select an answer first