Incident Assessment GCIL Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company's security team detects unusual network traffic from a server that hosts a public-facing application. The traffic appears to be data exfiltration to an unknown IP address. The server also contains the company's proprietary source code. The team must decide whether to disconnect the server immediately or continue monitoring. What is the most appropriate action?

   • ADisconnect the server immediately to stop the exfiltration, even if it disrupts the application.
   • BDisconnect the server after capturing a few minutes of traffic to preserve evidence and stop the exfiltration.
   • CContinue monitoring to gather more evidence about the exfiltration before taking action.
   • DIgnore the traffic because it may be a false positive.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company discovers that an attacker exfiltrated a database containing customer credit card numbers. The company must decide whether to notify affected customers immediately or wait until the investigation is complete. Which consideration is most important in this decision?

   • AThe need to complete a thorough forensic investigation before notifying anyone.
   • BThe desire to avoid public panic and negative media coverage.
   • CThe cost of providing credit monitoring services to affected customers.
   • DThe legal requirement to notify affected individuals within a specified timeframe.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization is investigating a suspected data breach. The incident response team has identified a server that may contain evidence. The server is a production system that cannot be taken offline. Which approach is most appropriate for preserving evidence?

   • APerform a live forensic acquisition of the server's memory and disk while it is running.
   • BCopy the relevant files to a network share and analyze them there.
   • CShut down the server and create a forensic image of the hard drive.
   • DWait until the server can be taken offline during a maintenance window.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A university's IT team is responding to a phishing campaign that compromised several student email accounts. The incident commander asks you to communicate the initial assessment to the university's executive leadership. Which communication approach is most appropriate?

   • AProvide a detailed technical timeline of the attack chain and all affected email servers.
   • BShare the raw email logs with leadership so they can see the evidence firsthand.
   • CSummarize the number of affected accounts, the type of data at risk, and the immediate containment actions taken.
   • DWait until the investigation is complete before sharing any information with leadership.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When assessing the impact of an incident, what does 'scope' refer to?

   • AThe number of users affected by the incident
   • BThe financial cost of the incident
   • CThe duration of the incident
   • DThe extent of systems, data, and processes affected
   Reveal Solution Discussion Select an answer first