Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   After a major incident, the incident response team conducts a lessons learned review. The team identifies that the incident was not detected quickly because the SIEM rules were not tuned to the organization's environment. The team also found that the incident response plan did not include clear criteria for escalating to senior management. Which improvement should the team prioritize to address both issues?

   • APurchase a new SIEM platform with better default rules.
   • BTune the SIEM rules to reduce false negatives and add escalation criteria to the incident response plan.
   • CConduct a tabletop exercise to test the incident response plan.
   • DTrain the SOC analysts on incident response procedures.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC analyst receives an alert about a user account performing a large number of file downloads from a file share. The user is a known employee, and the downloads are happening during business hours. The analyst must decide whether this is a potential incident. Which action is most appropriate for the identification phase?

   • AEscalate the alert to the incident response team immediately.
   • BIgnore the alert because the user is a known employee.
   • CImmediately block the user's account to prevent further downloads.
   • DCheck the user's normal behavior and the sensitivity of the files being downloaded.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An organization suffered a data breach through a compromised web server. The IR team has contained the server and identified that the attacker used a SQL injection vulnerability to access the database. The team must eradicate the root cause while minimizing downtime for the web application. Which approach is most effective?

   • AChange all database credentials and enable audit logging.
   • BDisable the database and web server until a full code review is completed.
   • CApply a Web Application Firewall (WAF) rule to block SQL injection attempts and then patch the application code.
   • DRebuild the web server from a clean image and restore the database from backup.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of the Lessons Learned phase?

   • ATo improve future incident response by documenting findings and updating plans
   • BTo identify the root cause of the incident
   • CTo restore systems to normal operation
   • DTo contain the incident and prevent further damage
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC analyst receives an alert from the SIEM about a user account failing to authenticate multiple times from an unusual geographic location. The analyst checks the user's recent activity and sees that the account has not been used for several days. The analyst must determine whether this is a true incident. Which action is most appropriate for the identification phase?

   • AImmediately disable the user account to prevent further access.
   • BEscalate the alert to the incident response team immediately without further investigation.
   • CIgnore the alert because the account has not been used recently.
   • DContact the user to verify whether they attempted to log in from that location.
   Reveal Solution Discussion Select an answer first