Incident Handling Process SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A CSIRT is responding to a ransomware incident that has encrypted files on a file server. The team has identified the ransomware variant and knows it communicates with a specific command-and-control server. The file server is critical to business operations and cannot be taken offline for more than a few hours. Which containment strategy should the team use first?

   • ABlock the command-and-control server at the firewall and isolate the file server from the network
   • BDisconnect the file server from the network and leave it offline until the investigation is complete
   • CImmediately restore the file server from backups
   • DPower off the file server to stop the encryption
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company has eradicated a ransomware infection from its file servers. The servers have been restored from clean backups, and the malware has been removed. What is the next step in the Recovery phase?

   • ADelete the ransomware samples from the sandbox
   • BMonitor the restored servers for any signs of re-infection
   • CUpdate the incident response plan
   • DConduct a lessons-learned meeting
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst detects a suspicious PowerShell process on a single workstation that is beaconing to an external IP. The workstation is not currently needed for any critical business function. The analyst needs to limit the impact while preserving the ability to investigate. Which action should the analyst take first?

   • ADisconnect the workstation from the network
   • BRun a full antivirus scan on the workstation
   • CRebuild the workstation from a known-good image
   • DBlock the external IP at the firewall
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC analyst sees a spike in outbound traffic from a database server at 3:00 AM. The analyst checks the server logs and finds a new scheduled task that was created an hour earlier. Which phase of the incident handling process is the analyst currently in?

   • AContainment
   • BRecovery
   • CEradication
   • DIdentification
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A malware outbreak is spreading across the corporate network. The incident response team has identified the affected systems and wants to stop the spread while they prepare a full eradication plan. Which containment strategy should they use FIRST?

   • ADisconnect the affected systems from the network immediately.
   • BWait for the malware to finish spreading before taking action.
   • CShut down the affected systems and begin eradication.
   • DApply firewall rules to block the malware's command-and-control traffic.
   Reveal Solution Discussion Select an answer first