Incident Handling Process SCE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A SOC analyst is responding to a suspected data exfiltration incident. The analyst has identified a compromised workstation and is about to isolate it from the network. Before isolating the workstation, which documentation action is most important?

   • ANote the workstation's IP address and hostname
   • BDocument the user's name and department
   • CTake a screenshot of the workstation's desktop
   • DRecord the current time, date, and any volatile evidence such as open network connections
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company wants to improve its ability to respond to security incidents. The CSIRT has been formed, and the team has deployed a SIEM and EDR tools. What additional activity is most important in the Preparation phase?

   • AHiring a third-party forensic firm
   • BPurchasing additional endpoint licenses
   • CEstablishing an incident response policy and procedures
   • DConducting a penetration test of the network
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the main purpose of the Lessons Learned phase?

   • ATo contain the incident and limit its impact
   • BTo document findings and improve future incident handling processes
   • CTo identify the attacker's identity
   • DTo restore systems to normal operation
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst receives an alert from the SIEM about a user account failing to authenticate 50 times in 10 minutes. The analyst checks the account and sees that the user is on vacation. Which step should the analyst take next in the Identification phase?

   • AConfirm the alert by correlating with other logs and sources
   • BReset the user's password
   • CDisable the user account immediately
   • DClose the alert as a false positive
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   After a significant data breach, the CSIRT has completed the recovery phase and restored all systems. The team is now meeting to discuss what went well and what could be improved. Which output is most important from this meeting?

   • AA list of action items to improve the incident response process
   • BA list of employees who were affected
   • CA timeline of the incident
   • DA forensic image of the compromised systems
   Reveal Solution Discussion Select an answer first