4.03 Determine the Appropriate Incident Response Plan Given Specific Attack Details 401 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the preparation phase of an incident response plan, which activity is most likely to be performed?

   • ADeveloping and testing response procedures
   • BIdentifying the source IP address of an attack
   • CConducting a post-incident review
   • DIsolating infected systems from the network
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During a malware infection incident, which response action is most appropriate to perform first to prevent the malware from spreading to other systems?

   • AIsolate the infected system from the network
   • BNotify the public relations team
   • CAnalyze the malware in a sandbox
   • DRebuild the operating system
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A large e-commerce company experiences a ransomware attack that encrypts files on several critical servers. The attack is spreading rapidly. The incident response team has been activated. Who should be notified FIRST according to the incident response plan?

   • AThe company's legal department and executive leadership
   • BThe affected server administrators only
   • CAll employees via a company-wide email
   • DThe public relations team to prepare a press release
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company's security team discovers that an attacker has been exfiltrating sensitive customer data from a database over the past three months. The attacker used a legitimate database administrator's credentials. The company is subject to data breach notification laws. What is the most appropriate response action?

   • AReset the database administrator's password and continue monitoring, but do not notify anyone
   • BShut down the database server to stop the exfiltration and then restore from backups
   • CImmediately notify all affected customers and regulators, then begin the investigation
   • DPreserve forensic evidence, determine the scope of the breach, and then notify affected parties as required by law
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After a phishing incident, a company's incident response team identifies that the email security gateway failed to block a malicious attachment because it was a new variant. What should be updated in the incident response plan?

   • AAdd a step to manually review all email attachments
   • BRemove the email security gateway and rely on user awareness
   • CUpdate the email security gateway rules to include the new variant's indicators
   • DIncrease the frequency of phishing simulations for employees
   Reveal Solution Discussion Select an answer first