Incident Handling Process SCE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During an incident, a SOC analyst takes a screenshot of a suspicious email and records the email header information in the incident ticket. Later, the analyst isolates the affected workstation. Why is it important to document the email header and the isolation action?

   • ATo preserve evidence and maintain a clear record of actions for the investigation
   • BTo reduce the need for containment
   • CTo prevent the attacker from returning
   • DTo speed up the eradication phase
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC analyst receives an alert about a user account that has been locked out after multiple failed login attempts. The analyst checks the account and sees that the user is on vacation. The analyst also notices that the failed attempts came from an IP address that is not in the company's VPN range. Which action should the analyst take next?

   • AUnlock the user's account and reset the password
   • BConfirm the incident by correlating the failed logins with other security events
   • CDisable the user account
   • DBlock the IP address at the firewall
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A server was compromised by an attacker who exploited a vulnerable service and installed a rootkit. The incident response team has contained the server and confirmed the rootkit is present. What is the MOST effective way to eradicate the rootkit?

   • ADelete the rootkit files manually from the server.
   • BRun an antivirus scan to remove the rootkit.
   • CReimage the server from a trusted source and apply all security patches.
   • DRestore the server from a backup taken before the incident.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC analyst sees an alert about a user account logging in from two different countries within 10 minutes. The analyst checks the logs and sees that the user is currently active in the office. What should the analyst do?

   • AContact the user to verify if they have logged in from another location.
   • BBlock the IP address of the second login location.
   • CDisable the user account immediately to prevent unauthorized access.
   • DIgnore the alert because the user is active in the office.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which activity is primarily associated with the Identification phase of incident handling?

   • AMonitoring systems and analyzing alerts to detect potential incidents
   • BRestoring systems from backups to return to normal operation
   • CDeleting malicious files from compromised hosts
   • DIsolating affected systems to prevent further damage
   Reveal Solution Discussion Select an answer first