Incident Handling Process SCE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which of the following is an example of a short-term containment strategy?

   • AConducting a full forensic analysis of the system
   • BApplying a permanent firewall rule to block malicious traffic
   • CRebuilding the system from a clean image
   • DDisconnecting an infected system from the network
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is building its incident response capability from scratch. They have a limited budget and cannot afford a full-time CSIRT. They want to ensure they can respond to incidents effectively. What is the MOST important thing to do during the Preparation phase?

   • APurchase the most expensive SIEM tool on the market.
   • BWait until an incident occurs to determine what is needed.
   • CHire a full-time CSIRT even if it exceeds the budget.
   • DDefine roles and responsibilities for incident response and train designated staff.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   During an incident, a SOC analyst takes a memory dump from a compromised workstation and saves it to a network share. The analyst also records the time and date of the dump in the incident log. Why is this documentation practice important?

   • AIt preserves the evidence for legal proceedings and maintains the chain of custody.
   • BIt ensures the memory dump is stored in a secure location.
   • CIt helps the analyst remember what was done during the incident.
   • DIt allows the analyst to delete the memory dump after the incident.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company has just completed the eradication phase of a malware incident. The affected systems have been cleaned, and the vulnerability has been patched. The CSIRT is now planning the recovery phase. Which approach best balances the need to return to business with the need to ensure the threat is fully gone?

   • AKeep the systems offline until the next scheduled maintenance window
   • BReturn the systems to production immediately and monitor them after hours
   • CRestore the systems from clean backups and monitor them for a period before returning to full production
   • DReturn the systems to production and schedule a lessons-learned meeting
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During an incident, the incident response team is collecting evidence from multiple systems. They need to ensure that the evidence is admissible in court. What should they do?

   • AAnalyze the evidence immediately without documenting the process.
   • BCopy the evidence to a personal USB drive for safekeeping.
   • CShare the evidence with all team members for analysis.
   • DDocument every action taken and preserve the evidence in its original state.
   Reveal Solution Discussion Select an answer first