4.03 Determine the Appropriate Incident Response Plan Given Specific Attack Details 401 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   During a high-impact data breach that affects customer data, which communication channel is most appropriate for notifying senior management?

   • AA message in a general chat room
   • BA post on the company's public website
   • CA direct phone call or secure messaging
   • DAn email to all employees
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company's security team detects a ransomware attack that has encrypted files on a file server. The ransomware note demands payment in cryptocurrency. The team also discovers that the attacker gained access through a compromised VPN account. The company has backups, but they are stored on the same network and may also be encrypted. What is the most appropriate incident response plan?

   • AContain the spread by disconnecting the file server and the VPN, then assess the integrity of backups before restoration
   • BRestore the file server from the backups immediately without checking their integrity
   • CPay the ransom immediately to restore access to the encrypted files
   • DIsolate the VPN account and reset all user passwords, but leave the file server online
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst observes a sudden increase in outbound DNS queries from multiple internal servers to a domain that is only a few days old. The queries are occurring at regular intervals. What is the most likely classification of this activity?

   • ANormal DNS resolution for a new internal service
   • BDNS tunneling as part of a data exfiltration attempt
   • CA DDoS attack against the DNS server
   • DA misconfigured DNS server causing recursive queries
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A government agency detects that an employee's credentials were used to access classified documents outside of working hours. The employee denies any involvement. The investigation reveals that the credentials were phished two weeks ago. Which incident response plan should be activated?

   • AInsider threat plan, focusing on user activity monitoring and access review
   • BDDoS response plan, implementing rate limiting on external connections
   • CData breach plan, focusing on containment and forensic investigation
   • DMalware response plan, scanning all systems for malicious software
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company's security team detects a sophisticated attack that involves both a DDoS attack on their public website and a simultaneous attempt to exploit a vulnerability in their internal application. The DDoS is consuming resources, while the exploitation attempt is targeting a server that contains sensitive customer data. What is the most appropriate incident response plan?

   • AActivate the insider threat plan because the attack is likely from an internal source
   • BActivate both plans simultaneously without prioritizing, as they are equally important
   • CActivate the DDoS response plan first to restore website availability, then address the exploitation attempt
   • DActivate the data breach response plan first to contain the exploitation attempt, while simultaneously mitigating the DDoS
   Reveal Solution Discussion Select an answer first