Incident Assessment GCIL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an example of an incident classification category?

   • AMalware infection
   • BSystem administrator
   • CFirewall rule
   • DPatch Tuesday
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A healthcare organization's SOC receives an alert about a workstation that repeatedly attempted to connect to a known command-and-control domain. The workstation belongs to a nurse who recently clicked a phishing link. The attempted connections were blocked by the firewall. Which classification best describes this incident?

   • AMalware infection with potential data exfiltration
   • BDenial of service against the workstation
   • CPhishing attempt that was successfully blocked
   • DSuccessful phishing with suspected malware beaconing
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A government agency's SOC identifies a suspicious login from a foreign IP address to a non-privileged user account. The login occurred at 3:00 AM local time, and the user is on vacation. No data was accessed. How should this incident be classified?

   • ADenial of service attack on the user account
   • BPotential unauthorized access requiring further investigation
   • CAccount compromise with confirmed data exfiltration
   • DRoutine login that requires no action
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A regional bank's security team detects a ransomware outbreak on a single file server in a branch office. The file server contains cached copies of customer statements but no authoritative customer database. The branch office is scheduled for closure in 60 days. The incident commander asks you to prioritize this incident. Which action best reflects proper triage prioritization?

   • AAssign high priority because any encryption of customer data requires immediate public disclosure under breach notification laws.
   • BAssign low priority because the branch office is closing and no customers will be affected by the loss of cached statements.
   • CAssign medium priority because the affected server holds non-authoritative data and the branch is closing soon, reducing long-term business impact.
   • DAssign high priority because ransomware always constitutes a critical incident regardless of the affected asset.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services firm discovers that a database containing customer financial records was accessed by an unauthorized party. The firm is assessing the impact of the incident. Which factor is most critical to include in the impact assessment?

   • AThe number of records accessed and the sensitivity of the data.
   • BThe IP address of the unauthorized party.
   • CThe time of day the unauthorized access occurred.
   • DThe name of the database administrator who last accessed the database.
   Reveal Solution Discussion Select an answer first