Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A small company is building its incident response capability. They have a limited budget and cannot afford a full-time incident response team. They want to ensure they can respond to incidents effectively. Which preparation activity is most cost-effective and impactful?

   • AHire a dedicated incident response team.
   • BWait until an incident occurs before developing a plan.
   • CPurchase an expensive commercial incident response retainer.
   • DDevelop an incident response plan and train existing staff on their roles.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst detects an infected workstation on the corporate network. The malware is actively communicating with a command-and-control server, but the analyst needs to preserve volatile evidence for later forensic analysis. The malware is not yet fully understood, and the analyst wants to prevent lateral movement while keeping the system available for continued monitoring. Which action best balances these needs?

   • AApply a host-based firewall rule to block only the command-and-control IP address.
   • BMove the workstation to a separate VLAN and allow all traffic to continue.
   • CPower off the workstation to stop the malware from spreading.
   • DDisconnect the network cable from the workstation immediately.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After a malware outbreak, the IR team has cleaned all affected workstations and servers. The team now needs to return the environment to normal operation. Which approach best aligns with the recovery phase?

   • AReconnect systems in phases, starting with non-critical systems, and monitor them for signs of reinfection.
   • BKeep all systems disconnected until the next scheduled maintenance window.
   • CReconnect all systems at once and resume normal business immediately.
   • DRestore all systems from backups taken during the incident.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the main goal of the Recovery phase in incident response?

   • ATo identify the root cause of the incident
   • BTo contain the incident and prevent spread
   • CTo restore affected systems to normal operation
   • DTo document lessons learned
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC team detects a worm spreading across the internal network. The worm is actively encrypting files on multiple servers. The team needs to stop the spread quickly while preserving forensic evidence. Which containment strategy is most appropriate?

   • AWait for the worm to finish encrypting files before taking action.
   • BDisconnect the affected servers from the network immediately.
   • CReboot the servers to clear the worm from memory.
   • DRun an antivirus scan on the servers without disconnecting them.
   Reveal Solution Discussion Select an answer first