Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of the Eradication phase?

   • ATo contain the incident and prevent further spread
   • BTo restore systems to normal operation
   • CTo detect and confirm the incident
   • DTo remove the root cause of the incident from affected systems
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A post-incident review reveals that the IR team spent too much time during the identification phase because there was no predefined triage criteria for alerts. The team also lacked a clear escalation path for critical incidents. What should the lessons-learned phase prioritize to improve future response?

   • ADisable low-priority alerts to reduce the number of alerts the team must review.
   • BDevelop a triage checklist and define escalation thresholds for different incident severities.
   • CIncrease the number of security analysts on the team.
   • DPurchase a new SIEM tool to reduce alert noise.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC analyst sees a spike in outbound network traffic from a single workstation to an external IP address that is not on any known threat intelligence feed. The workstation is a standard user machine. The analyst needs to determine if this is a security incident. Which action is most appropriate during the identification phase?

   • AImmediately block the external IP address at the firewall.
   • BDisconnect the workstation from the network immediately.
   • CInvestigate the workstation for signs of malware or unusual processes.
   • DIgnore the traffic because the IP is not on a threat intelligence feed.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which activity is part of the Recovery phase?

   • ARemoving malware from affected systems
   • BDisconnecting affected systems from the network
   • CGradually reintegrating restored systems into the production network
   • DConducting a post-incident review
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A ransomware outbreak is spreading rapidly across a network. The incident response team has identified the initial infection vector and several affected hosts. The team needs to contain the incident to prevent further spread, but some affected hosts are critical servers that cannot be taken offline. Which containment strategy best balances the need to stop the spread with the need to keep critical services running?

   • ADisconnect all affected hosts from the network immediately.
   • BPower off the critical servers to prevent them from being encrypted.
   • CSegment the network to isolate affected hosts while keeping critical servers accessible through controlled access.
   • DLet the ransomware run its course and then restore from backups.
   Reveal Solution Discussion Select an answer first