Incident Remediation and Closure GCIL Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   After a malware infection on a file server, the incident response team has removed the malware and restored the server from a clean backup. However, the team is unsure if the malware persists in the backup itself. What is the most appropriate next step?

   • ADelete the backup and create a new one from the restored server.
   • BScan the restored server and the backup media with updated antivirus and anti-malware tools.
   • CChange the server's administrator password and enable auditing.
   • DReconnect the server to the network and monitor for any signs of re-infection.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which activity is part of the recovery phase after an incident has been eradicated?

   • AConducting a lessons-learned meeting
   • BIdentifying the attack vector
   • CIsolating affected network segments
   • DRestoring systems from known-good backups
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which containment measure is typically implemented first to quickly limit the spread of an active attack?

   • ARecovery
   • BShort-term containment
   • CEradication
   • DLong-term containment
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is responding to a supply-chain attack where a software update from a trusted vendor contained malware. The malware has been detected on several systems, but the vendor has not yet released a patched version. The company needs to continue using the software for critical business operations. What is the most appropriate remediation strategy?

   • AIsolate the affected systems and implement compensating controls, such as application whitelisting and network restrictions.
   • BWait for the vendor to release a patched version before taking any action.
   • CUninstall the software from all systems immediately.
   • DRoll back to a previous version of the software that is not affected.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   An incident response team has completed eradication and recovery, but the incident commander is concerned that the closure criteria were not fully defined at the start of the incident. What should the team do?

   • AAsk the legal team to decide when the incident is closed.
   • BClose the incident immediately because the technical work is done.
   • CReopen the incident and start the response process over.
   • DDefine closure criteria now based on the incident's scope and validate them before closing.
   Reveal Solution Discussion Select an answer first