Incident Response Concepts and Application GCED Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which action is part of the recovery phase of incident response?

   • ADeleting malware from infected systems
   • BRestoring systems from clean backups
   • CIsolating affected systems from the network
   • DConducting a post-incident review
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   During a major incident, the incident commander is receiving conflicting information from multiple analysts. Some analysts report that the incident is contained, while others report ongoing activity. The incident commander needs to make a decision about whether to declare the incident contained. What should the incident commander do?

   • ADelegate the decision to the lead analyst.
   • BGather additional data from all sources, verify the reports, and make a decision based on the most reliable evidence.
   • CDeclare the incident not contained because any conflicting report means the incident is ongoing.
   • DDeclare the incident contained based on the majority of analysts' reports.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company's web server is defaced by an attacker who exploited a vulnerable plugin. The server is business-critical and must be restored quickly. The incident response team has identified the vulnerability and has a patched version of the application. Which recovery strategy is most appropriate?

   • ARestore from a clean backup and apply the patch before putting the server back online.
   • BPut the server back online as-is and monitor for further attacks.
   • CRebuild the server from the original installation media without applying patches.
   • DDisconnect the server permanently and move to a new provider.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which incident response team role is responsible for making final decisions about response strategy and resource allocation during an incident?

   • AScribe
   • BIncident Commander
   • CCommunications Lead
   • DLead Analyst
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company's security team discovers that an attacker has established persistence on several servers via a scheduled task that downloads and executes a payload from a remote server. The team needs to stop the immediate damage while preserving the ability to investigate. Which containment strategy should be implemented first?

   • ADisconnect the servers from the network but leave the scheduled tasks enabled.
   • BDisable the scheduled tasks on all affected servers and block the remote server's IP at the firewall.
   • CChange all administrative passwords and then continue monitoring.
   • DReimage all affected servers immediately to ensure the malware is removed.
   Reveal Solution Discussion Select an answer first