Enterprise Environment Incident Response GCFA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which enterprise department is most likely to provide the incident response team with information about affected business processes and the potential operational impact of a security incident?

   • AProcurement
   • BFacilities Management
   • CHuman Resources
   • DBusiness Unit Management
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An IR team is collecting evidence from a compromised server. The team has imaged the hard drive and is now collecting network logs from the firewall. Which action is most important to maintain the chain of custody for the network logs?

   • AStore the logs on the compromised server's hard drive.
   • BDelete any logs that are not directly related to the incident.
   • CEmail the logs to the entire IR team for review.
   • DDocument who collected the logs, when they were collected, and how they were transferred and stored.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   During a suspected data exfiltration incident, the incident response team needs to preserve a compromised server's memory for later forensic analysis. The server is a critical production system that cannot be taken offline. The team has remote administrative access. Which action best balances forensic integrity with operational continuity?

   • AUse a trusted forensic tool to capture memory to a network share, then hash the capture file and record the hash in the chain-of-custody log.
   • BPower down the server immediately to freeze the state of memory, then remove the physical drives for imaging.
   • CCopy the contents of memory to a local file on the server's disk, then email that file to the forensic analyst.
   • DRun the vendor's built-in memory dump utility and save the output to the server's existing page file.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's IR policy states that all incidents must be reported to the IR team lead within 15 minutes of detection. A SOC analyst detects a potential incident but waits 30 minutes because they are unsure if it is a real incident. What is the most appropriate action for the SOC analyst?

   • AIgnore the alert if it is likely a false positive.
   • BWait until the analyst is certain it is a real incident before reporting.
   • CReport the incident to the SOC manager instead of the IR team lead.
   • DReport the potential incident to the IR team lead immediately, even if it turns out to be a false positive.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company's business continuity plan (BCP) designates a recovery time objective (RTO) of 4 hours for its customer relationship management (CRM) system. A ransomware attack encrypts the CRM servers. The IR team is in the containment phase. Which action best supports meeting the RTO?

   • AWait until the IR investigation is complete before restoring the CRM system.
   • BRestore the CRM system from backups to a clean environment while the IR team continues to investigate the attack.
   • CKeep the CRM system offline until the ransomware is fully eradicated from all systems.
   • DRebuild the CRM system from scratch without using backups.
   Reveal Solution Discussion Select an answer first