An incident response team discovers a low-impact malware infection on a single workstation. According to the escalation procedures, what is the most appropriate action?

Escalate immediately to the CEO

Contact law enforcement immediately

Handle it within the incident response team without escalation

A hospital's IT team discovers that a phishing email was opened by a staff member, and the attacker has gained access to a database containing patient records. The database is on a server that also hosts other critical applications. What is the most appropriate immediate response action?

Change the passwords of all users who have access to the database

Isolate the database server from the network while preserving forensic evidence

Notify the patients whose data may have been exposed

Shut down the server immediately to stop the attack

A financial services company's security team detects a large-scale SYN flood targeting their public-facing web application. The attack is consuming all available connection slots, causing legitimate users to experience timeouts. The source IPs are distributed across multiple countries and appear to be spoofed. Which incident response plan should the team activate?

Data breach notification plan, alerting customers and regulators immediately

Malware containment plan, isolating affected servers and scanning for malicious payloads

DDoS response plan, focusing on traffic scrubbing and rate limiting at the perimeter

Insider threat plan, revoking access for all users with administrative privileges

A security analyst discovers that an employee has been exfiltrating sensitive company data to a personal cloud storage account. Which incident response plan is most appropriate to select?

An insider threat response plan

A security analyst notices unusual outbound traffic from a single workstation to an external IP address known to be a command-and-control server. The workstation has been sending encrypted data packets at regular intervals. What is the most likely classification of this incident?

Malware infection with data exfiltration

Misconfiguration of the workstation's firewall

Distributed denial-of-service attack

Insider threat from a disgruntled employee

F5Certified Solution Expert, Security

Domain 4Objective 3

4.03 Determine the Appropriate Incident Response Plan Given Specific Attack Details 401 Practice Questions (Page 2)

Part of the SECURITY RESPONSE domain, which makes up ~24% of our current practice bank. F5 does not publish an official question count, but from its 105-minute exam (~40–70 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

Questions 6–10

6foundation · easy
An incident response team discovers a low-impact malware infection on a single workstation. According to the escalation procedures, what is the most appropriate action?
Select an answer first
7application · medium
A hospital's IT team discovers that a phishing email was opened by a staff member, and the attacker has gained access to a database containing patient records. The database is on a server that also hosts other critical applications. What is the most appropriate immediate response action?
Select an answer first
8application · medium
A financial services company's security team detects a large-scale SYN flood targeting their public-facing web application. The attack is consuming all available connection slots, causing legitimate users to experience timeouts. The source IPs are distributed across multiple countries and appear to be spoofed. Which incident response plan should the team activate?
Select an answer first
9foundation · easy
A security analyst discovers that an employee has been exfiltrating sensitive company data to a personal cloud storage account. Which incident response plan is most appropriate to select?
Select an answer first
10application · medium
A security analyst notices unusual outbound traffic from a single workstation to an external IP address known to be a command-and-control server. The workstation has been sending encrypted data packets at regular intervals. What is the most likely classification of this incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “401” is a trademark of its owner, used for identification only.