Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security incident occurred because a critical server was not included in the patch management process. After the incident, the IR team wants to prevent similar incidents. What should the lessons-learned phase recommend?

   • AIncrease the frequency of vulnerability scans.
   • BUpdate the asset inventory and ensure all critical servers are included in the patch management process.
   • CDisable the server's internet access to reduce exposure.
   • DReplace the server with a newer model.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst sees multiple failed logins for a service account followed by a successful login from an unusual IP address. The account has administrative privileges on a critical database. What should the analyst do during the identification phase?

   • AChange the account password and require multi-factor authentication.
   • BCorrelate the alert with other logs, such as the database audit trail and VPN logs, to confirm whether the login was malicious.
   • CDisable the service account immediately to stop any further unauthorized access.
   • DIgnore the alert because failed logins are common for service accounts.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which sequence correctly lists the six phases of the incident response lifecycle as defined by the EC-Council SOC Essentials framework?

   • APreparation, Identification, Containment, Eradication, Recovery, Lessons Learned
   • BPreparation, Containment, Identification, Eradication, Recovery, Lessons Learned
   • CPreparation, Identification, Eradication, Containment, Recovery, Lessons Learned
   • DIdentification, Preparation, Containment, Eradication, Recovery, Lessons Learned
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which action is typically taken during the Lessons Learned phase?

   • AUpdating the incident response plan based on identified gaps
   • BRestoring systems from backups
   • CIsolating affected systems from the network
   • DDeleting malware from affected systems
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A hospital's IR team detects a ransomware outbreak on the administrative network. The ransomware appears to be spreading toward the medical devices network, which cannot be disrupted. The team has limited ability to isolate the medical network without causing downtime. Which containment approach best balances patient safety and stopping the spread?

   • AWait to see if the ransomware reaches the medical network before taking action.
   • BApply network segmentation rules to block traffic between the administrative network and the medical devices network.
   • CDisconnect only the infected administrative servers and leave the rest of the network running.
   • DImmediately shut down the medical devices network to prevent ransomware from reaching it.
   Reveal Solution Discussion Select an answer first