Incident Response and Cyber Investigation GCIH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An incident handler is investigating a data breach that involves customer personal information. The company's legal counsel has asked the handler to preserve all relevant evidence. Which action is most appropriate?

   • AIgnore the request because the breach is already contained.
   • BShare the evidence with all employees to increase awareness.
   • CPlace a legal hold on all relevant systems and data to prevent deletion or alteration.
   • DDelete any duplicate data to reduce storage costs.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A small company has no dedicated incident response team. An employee discovers a potential data breach. According to incident response fundamentals, what is the first step the employee should take?

   • AWait to see if the breach causes any visible damage before reporting.
   • BAttempt to contain the breach by disconnecting affected systems.
   • CDelete any suspicious files to prevent further damage.
   • DReport the potential breach to the designated incident response contact or manager.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An incident handler is investigating a suspected data exfiltration by an employee. The employee's personal smartphone is found on the company premises. The company's policy allows monitoring of company-owned devices but not personal devices. What should the incident handler do?

   • ADo not search the smartphone and document that it was not examined due to privacy policy.
   • BConfiscate the smartphone and image it for evidence.
   • CSearch the smartphone without consent because it is on company premises.
   • DAsk the employee for the passcode and search the phone.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After a security incident, the incident response team is in the recovery phase. Which action is most appropriate during this phase?

   • ARestore systems from backups and monitor them for any signs of reinfection.
   • BDisconnect all systems from the network to prevent further spread.
   • CConduct a lessons-learned meeting immediately.
   • DDelete all backups to prevent the malware from spreading.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An incident handler is responding to a malware outbreak on several workstations. The team has isolated the affected systems. What should be done next in the incident response process?

   • AEradicate the malware from the systems and then recover them to normal operation.
   • BConduct a lessons-learned meeting before eradicating the malware.
   • CNotify the public about the incident before completing the investigation.
   • DImmediately reconnect the systems to the network to resume business operations.
   Reveal Solution Discussion Select an answer first