Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 10)

Questions 46–48

1. 46foundation · easy

   Which activity is performed during the Eradication phase?

   • APatching the vulnerability that was exploited
   • BIsolating the affected network segment
   • CRestoring data from backups
   • DReviewing the incident response process
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A server was compromised through a vulnerable web application. The incident response team contained the incident by isolating the server. During the eradication phase, the team needs to remove the root cause. Which action is most appropriate for eradication?

   • APatch the web application vulnerability and remove any malicious files.
   • BRestore the server from a backup taken before the incident.
   • CReconnect the server to the network and monitor for further activity.
   • DIncrease logging on the server to capture more information.
   Reveal Solution Discussion Select an answer first
3. 48foundation · easy

   What is the main objective of the Containment phase in incident response?

   • ATo limit the impact and prevent further damage from the incident
   • BTo document all actions taken during the incident
   • CTo restore systems to their normal state
   • DTo identify the root cause of the incident
   Reveal Solution Discussion Select an answer first