Incident Response Concepts and Application GCED Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which incident type is typically classified as having the highest severity?

   • AA user reporting a slow network connection
   • BA phishing email that was not clicked
   • CA ransomware infection on a critical server
   • DA single workstation with adware
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company discovers that an attacker has compromised a domain controller and used it to move laterally to several file servers. The attacker's activity appears to be ongoing. The company's priority is to stop the attacker while preserving evidence for a criminal investigation. Which containment strategy is most appropriate?

   • ADisconnect the compromised domain controller and file servers from the network, but do not power them off, to preserve evidence.
   • BRebuild the domain controller and file servers from backups immediately.
   • CDisable the attacker's user accounts and hope the attacker loses access.
   • DReset the domain controller's password and continue monitoring.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which type of forensic analysis would be most useful for determining what actions a user performed on a system at a specific time?

   • ANetwork forensics
   • BSteganalysis
   • CLog analysis
   • DMemory forensics
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which benefit do standardized incident response procedures provide?

   • AThey promote consistent and effective response actions across incidents
   • BThey eliminate the need for human judgment during an incident
   • CThey guarantee that incidents are resolved without any errors
   • DThey ensure that every incident is handled in the same way, regardless of type
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo document who handled the evidence and when, ensuring its integrity and admissibility
   • BTo ensure the evidence is stored in a secure location
   • CTo make copies of the evidence for analysis
   • DTo encrypt the evidence to prevent unauthorized access
   Reveal Solution Discussion Select an answer first