Defensive Infrastructure and Tactics GCED Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is recovering from a ransomware attack that affected multiple servers in the same subnet. The incident response team has identified the initial entry point and is ready to restore systems. The company wants to prevent a recurrence and improve future response. Which set of actions is most comprehensive?

   • AIncrease logging on the affected servers and monitor for similar activity.
   • BRestore all systems from backup and change all user passwords.
   • CReimage all affected servers and reconnect them to the network immediately.
   • DPatch the vulnerability, segment the affected subnet into smaller zones, and add threat intelligence indicators to the firewall blocklist.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary goal of the containment phase in incident response?

   • ATo limit the damage and prevent further spread of the incident
   • BTo collect evidence for legal proceedings
   • CTo restore systems to normal operation
   • DTo identify the root cause of the incident
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What does a sudden spike in outbound DNS queries from an internal host often indicate?

   • AA potential data exfiltration attempt using DNS tunneling
   • BNormal web browsing activity
   • CA distributed denial-of-service attack against the DNS server
   • DA misconfigured DHCP server
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has experienced a ransomware attack that encrypted files on several file servers. The incident response team has identified the initial entry point as a phishing email with a malicious attachment. The team has contained the spread by isolating the affected servers. What is the next step in the incident response process?

   • AConduct a lessons-learned review to identify improvements to the security posture.
   • BEradicate the threat by removing the malware from all affected systems and restoring the encrypted files from backups.
   • CImmediately notify law enforcement and the media about the incident.
   • DReimage all affected servers and restore data from backups, but do not investigate the root cause.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary role of an intrusion prevention system (IPS) in a network defense architecture?

   • ATo log all network traffic for forensic analysis
   • BTo detect and automatically block malicious traffic in real time
   • CTo encrypt traffic between remote users and the corporate network
   • DTo route traffic between different network segments
   Reveal Solution Discussion Select an answer first