4.03 Determine the Appropriate Incident Response Plan Given Specific Attack Details 401 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An organization detects a data breach where an attacker has accessed a database containing customer records. Which response action is most appropriate to preserve evidence for forensic analysis?

   • ARestore the database from a backup
   • BTake a forensic image of the affected systems
   • CImmediately shut down the database server
   • DDelete the attacker's access logs
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An organization is experiencing a distributed denial-of-service (DDoS) attack that is overwhelming its public-facing web server. Which incident response plan is most appropriate to select?

   • AA data breach notification plan
   • BA malware containment and eradication plan
   • CA DDoS mitigation and response plan
   • DAn insider threat response plan
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's security team discovers that an attacker has been using a compromised service account to access a file share containing intellectual property. The attacker has been copying files over the past week. What is the most appropriate immediate response action?

   • ARestore the file share from a backup to remove any malicious files
   • BDisable the service account and revoke its access to the file share
   • CNotify the intellectual property owners and ask them to change their passwords
   • DMonitor the account to gather more evidence before taking action
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's web server is defaced with a political message. The server also hosts the company's customer database. The security team suspects the attacker exploited a vulnerability in the web application. What is the most appropriate response action?

   • AImmediately patch the web application vulnerability and bring the server back online
   • BIsolate the server, preserve forensic evidence, and assess the integrity of the database
   • CNotify customers that their data may have been exposed
   • DTake the web server offline and restore from a known-good backup
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An incident response analyst receives an alert about a malware infection on a single workstation. The malware is known to be low-risk and has not spread. According to attack classification and triage, what should the analyst determine first?

   • AThe cost of the malware infection
   • BThe public relations impact of the incident
   • CThe severity and priority of the incident
   • DThe exact version of the malware
   Reveal Solution Discussion Select an answer first