Incident Remediation and Closure GCIL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An incident response team has completed the eradication and recovery phase. The incident commander asks for a final report. What should the report primarily include to support formal closure?

   • AA list of all hardware that was replaced during the incident.
   • BOnly the names of the team members who participated in the response.
   • CA chronological timeline of events, actions taken, evidence collected, and validation of closure criteria.
   • DA summary of the attacker's likely motivation without technical details.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a web server was compromised through an unpatched vulnerability in a third-party plugin, the incident response team removed the malicious files and restored the website from a clean backup. What additional step is essential to prevent the same vulnerability from being exploited again?

   • AMonitor the web server logs for any signs of re-infection.
   • BApply the vendor's security patch to the plugin and verify the patch is effective.
   • CChange the administrator password for the web server.
   • DDisable the third-party plugin permanently.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company discovers that an attacker has been exfiltrating data from a database over the past three weeks. The database is critical for daily operations. What is the most appropriate initial remediation strategy?

   • ARestore the database from a backup taken before the incident without further analysis.
   • BImmediately shut down the database server to stop the exfiltration.
   • CIgnore the exfiltration until after business hours to avoid disruption.
   • DApply short-term containment by restricting network access to the database while preserving evidence, then plan long-term eradication.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After a malware infection, the team has removed the malware from all systems and restored them from clean backups. What should the team do to ensure the systems are truly secure before returning them to production?

   • AReimage the systems again to be extra safe.
   • BChange all user passwords but do not update the systems.
   • CVerify that all systems are patched, have updated antivirus definitions, and are monitored by the security operations center.
   • DReturn the systems to production immediately to minimize downtime.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company discovers that an insider is exfiltrating data through a legitimate cloud storage service. The insider is a senior employee who is currently on leave. The company wants to stop the exfiltration without alerting the insider. What is the best containment action?

   • AMonitor the insider's activity without taking any action.
   • BConfront the insider immediately and ask them to stop.
   • CTemporarily revoke the insider's access to the cloud storage service while preserving logs and monitoring for any other suspicious activity.
   • DDisable the entire cloud storage service for all employees.
   Reveal Solution Discussion Select an answer first