Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is most closely associated with the Identification phase?

   • AAnalyzing a SIEM alert to determine if it indicates a real threat
   • BApplying a security patch to a vulnerable server
   • CUpdating the incident response plan based on lessons learned
   • DRestoring data from a backup
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   After a security incident, the incident response team has completed eradication and is ready to begin the recovery phase. The affected systems include a web server and a database server. The team must restore these systems to normal operation while minimizing the risk of re-infection. Which recovery approach is best?

   • ARestore both servers but skip validation to speed up the process.
   • BRestore the web server first, validate it, then restore the database server, and monitor both.
   • CRestore the database server first because it contains critical data, then the web server.
   • DRestore both servers simultaneously and monitor them closely for any signs of re-infection.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary goal of the Identification phase in incident response?

   • ATo restore affected systems to normal operation
   • BTo limit the impact of the incident
   • CTo detect and confirm whether a security incident has occurred
   • DTo remove the root cause of the incident
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is preparing its incident response capability. The security team has limited resources and must decide where to focus their preparation efforts. They have identified that their main risk is phishing attacks leading to credential compromise. Which preparation activity is most aligned with this risk?

   • APurchase a cyber insurance policy to cover potential losses.
   • BConduct a penetration test to identify other vulnerabilities.
   • CDeploy email filtering and multi-factor authentication (MFA) to reduce the likelihood of successful phishing.
   • DDevelop a communication plan for notifying customers after a breach.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an incident, the IR team identified that an attacker exploited an unpatched vulnerability in an internet-facing web server and installed a web shell. The team has isolated the server and is ready to remove the threat. Which action is part of the eradication phase?

   • ANotify the public about the breach.
   • BReconnect the server to the network to verify normal operation.
   • CApply the vendor's security patch to close the vulnerability that was exploited.
   • DIncrease the log retention period for the server.
   Reveal Solution Discussion Select an answer first