A SOC analyst sees a spike in failed login attempts against a domain controller. The analyst checks the logs and sees that the attempts are coming from a single external IP address and have been ongoing for 30 minutes. No account has been compromised yet. What should the analyst do FIRST?

Disable the domain controller's network access to prevent further attempts.

Ignore the alert because no account has been compromised.

Block the external IP address at the firewall.

Perform an initial assessment to determine if this is a true incident.

Which activity is part of the Eradication phase?

Deleting malware and closing the vulnerabilities that were exploited

Monitoring systems for signs of reinfection

Isolating the affected network segment

A company has just finished eradicating a web server compromise. The server has been rebuilt from a known-good image, and the vulnerability that was exploited has been patched. What should the team do next to complete the Recovery phase?

Validate the server's functionality and monitor it for abnormal activity

Conduct a lessons-learned meeting with the incident response team

Update the incident documentation with the eradication steps

Return the server to production and close the incident ticket

A post-incident review reveals that the SOC team did not have a clear escalation path, which delayed the response to a critical incident. What should the organization do to address this finding?

Blame the SOC team for the delay and move on.

Update the incident response plan to include a clear escalation path and train the team on it.

Purchase a new SIEM tool to improve detection.

Ignore the finding because the incident is over.

A phishing campaign successfully compromised three employee accounts, and the incident has been fully contained and eradicated. The CSIRT is now conducting a post-incident review. Which activity is most important during the Lessons Learned phase?

Resetting the passwords of the affected accounts

Restoring the affected systems from backups

Deleting the phishing emails from all user mailboxes

Documenting the timeline of the incident and identifying process improvements

EC-CouncilSOC Essentials

Domain 8Objective 1

Incident Handling Process SCE Practice Questions (Page 4)

Part of the Incident Response and Handling domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 2–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 16–20

16application · medium
A SOC analyst sees a spike in failed login attempts against a domain controller. The analyst checks the logs and sees that the attempts are coming from a single external IP address and have been ongoing for 30 minutes. No account has been compromised yet. What should the analyst do FIRST?
Select an answer first
17foundation · easy
Which activity is part of the Eradication phase?
Select an answer first
18application · medium
A company has just finished eradicating a web server compromise. The server has been rebuilt from a known-good image, and the vulnerability that was exploited has been patched. What should the team do next to complete the Recovery phase?
Select an answer first
19application · medium
A post-incident review reveals that the SOC team did not have a clear escalation path, which delayed the response to a critical incident. What should the organization do to address this finding?
Select an answer first
20application · medium
A phishing campaign successfully compromised three employee accounts, and the incident has been fully contained and eradicated. The CSIRT is now conducting a post-incident review. Which activity is most important during the Lessons Learned phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.