Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC analyst sees an alert for a user account that has been locked out multiple times, followed by a successful login from a foreign IP address. The user is on vacation and has not logged in. The analyst must decide whether to escalate the incident. What is the most appropriate action during the identification phase?

   • ACorrelate the login with VPN logs, geolocation data, and the user's known travel patterns to confirm if it is a true positive.
   • BIgnore the alert because the user is on vacation and the login may be a false positive.
   • CChange the user's password and require MFA on the next login.
   • DImmediately disable the user account and escalate to the incident response team.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a phishing incident that compromised two executive accounts, the IR team completed eradication and recovery. During the post-incident review, the team discovers that the detection was delayed because the email gateway's quarantine alerts were sent to a shared mailbox that no one monitored during weekends. Which output should the review produce to prevent a recurrence?

   • AAn updated incident response plan that assigns 24/7 monitoring responsibility for quarantine alerts to a specific on-call analyst.
   • BA decision to disable quarantine alerts to reduce noise for the security team.
   • CA request to increase the email retention period for executive mailboxes.
   • DA recommendation to replace the email gateway with a more advanced threat-detection product.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   After a ransomware incident, the IR team has eradicated the malware from all systems. However, the organization's backup repository was also encrypted, and the only clean backups are from two weeks ago. The business needs to restore operations quickly, but there is concern about data loss. Which recovery approach is most appropriate?

   • AKeep the systems offline until new backups can be created from the current state.
   • BAttempt to decrypt the encrypted backups using the attacker's decryption tool.
   • CRestore from the two-week-old backups and accept the data loss, then implement additional monitoring to detect any residual issues.
   • DReconstruct the lost data manually from user memory and paper records.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which action is an example of a containment strategy?

   • AReimaging the infected workstation
   • BDeleting malware from the infected workstation
   • CConducting a post-incident review
   • DDisconnecting an infected workstation from the network
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A manufacturing company detects ransomware on a file server that also hosts a legacy production database. The database cannot be shut down for more than 30 minutes without causing assembly-line stoppage. The IR team needs to stop the spread while preserving the ability to continue production. Which action should the team take first?

   • ADisconnect the file server from the network but keep the database service running.
   • BImmediately shut down the server to prevent further encryption and then restore from backup.
   • CApply a host firewall rule to block all inbound and outbound traffic except to the database clients and the IR jump host.
   • DDelete the ransomware files from the server before isolating it.
   Reveal Solution Discussion Select an answer first