Incident Response and Cyber Investigation GCIH Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security operations center receives three alerts simultaneously: (1) a phishing email reported by one user, (2) an IDS alert for a possible SQL injection on a public-facing web server, and (3) a failed login alert for a domain administrator account. The incident handler has limited staff. Which alert should be investigated first?

   • AInvestigate all three simultaneously with the same priority.
   • BThe failed login alert, because a domain administrator account is critical to the organization.
   • CThe SQL injection alert, because it targets a public-facing system.
   • DThe phishing email, because it is the most common attack vector.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An incident handler is investigating a case that may involve a minor's personal data. Which action is most appropriate to comply with privacy regulations?

   • ADelete the data immediately after collection to avoid privacy issues.
   • BShare the data with all team members to ensure transparency.
   • CCollect and store the data without any special handling.
   • DMinimize the collection of personal data to only what is necessary for the investigation.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an ethical consideration for an incident handler during an investigation?

   • ARespecting the privacy of individuals whose data may be involved
   • BUsing any means necessary to identify the attacker
   • CDeleting evidence that could be embarrassing to the organization
   • DSharing incident details with all employees to raise awareness
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During an investigation, an incident handler needs to collect network traffic logs from a firewall that is still in production. What is the best approach to preserve the logs as evidence?

   • ACopy the logs to a secure forensic server and compute hash values for the copies.
   • BTake a photograph of the firewall's log display.
   • CStop the firewall to prevent new logs from overwriting the evidence.
   • DPrint the logs and sign the printout.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company's incident response team is handling a ransomware incident that has encrypted files on several file servers. The CEO is pressuring the team to pay the ransom to restore operations quickly. The incident handler must advise the CEO. Which consideration is most important in this decision?

   • APaying the ransom is always the fastest way to recover data.
   • BPaying the ransom guarantees that the files will be decrypted.
   • CPaying the ransom may fund criminal activities and does not guarantee recovery.
   • DPaying the ransom is illegal in all jurisdictions.
   Reveal Solution Discussion Select an answer first