Why is it important to log all actions taken during an incident?

To prevent the attacker from accessing the system

To provide a detailed record for analysis, reporting, and potential legal proceedings

To automatically restore the system to normal operation

To ensure that the incident is contained quickly

A company is creating its incident response plan. They want to ensure that when an incident occurs, the right people are notified quickly and the response is coordinated. What should they include in the Preparation phase?

A detailed guide on how to use the SIEM tool.

A communication plan that lists key contacts and escalation procedures.

A list of all employees' personal phone numbers.

A malware infection has spread to a small number of workstations in a single department. The CSIRT needs to contain the incident while allowing the rest of the company to continue working. Which containment strategy is most appropriate?

Disable all user accounts in the company

Shut down the entire corporate network

Block all outbound internet traffic

Isolate the affected workstations by disconnecting them from the network

Why is it important to eliminate all artifacts left by an attacker during the Eradication phase?

To prevent the attacker from regaining access to the environment

To restore the system to its original state

To identify the attacker's identity

To ensure that the incident is properly documented

What is the main goal of the Containment phase in incident handling?

To limit the impact of the incident and prevent further damage

To restore systems to normal operation

To document all actions taken during the incident

To identify the root cause of the incident

EC-CouncilSOC Essentials

Domain 8Objective 1

Incident Handling Process SCE Practice Questions (Page 5)

Part of the Incident Response and Handling domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 2–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 21–25

21foundation · easy
Why is it important to log all actions taken during an incident?
Select an answer first
22application · medium
A company is creating its incident response plan. They want to ensure that when an incident occurs, the right people are notified quickly and the response is coordinated. What should they include in the Preparation phase?
Select an answer first
23application · medium
A malware infection has spread to a small number of workstations in a single department. The CSIRT needs to contain the incident while allowing the rest of the company to continue working. Which containment strategy is most appropriate?
Select an answer first
24foundation · easy
Why is it important to eliminate all artifacts left by an attacker during the Eradication phase?
Select an answer first
25foundation · easy
What is the main goal of the Containment phase in incident handling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.