Incident Remediation and Closure GCIL Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   During the post-incident review of a phishing campaign that led to credential compromise, the team notes that the email gateway had been configured to allow messages from a specific external domain because of a business partner. The review identifies that the gateway rule was overly broad. What is the most effective improvement to recommend?

   • AIncrease the frequency of phishing simulations for all employees.
   • BRemove the overly broad email gateway rule and implement a more specific allowlist for the partner domain.
   • CDisable email communication with the partner domain entirely.
   • DRequire all employees to complete annual security awareness training.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is experiencing a DDoS attack that is overwhelming its internet-facing services. The attack is causing significant downtime, and the team is considering whether to implement rate limiting or to fail over to a cloud-based DDoS protection service. What is the most important factor in deciding the remediation strategy?

   • AThe preference to use only in-house solutions to maintain control.
   • BThe need to preserve forensic evidence of the attack.
   • CThe ability to maintain service availability while mitigating the attack, considering the cost and complexity of each option.
   • DThe desire to avoid any additional cost, even if it means longer downtime.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company has been responding to a phishing incident that resulted in the compromise of several executive email accounts. The incident response team has reset the compromised accounts, removed the phishing emails, and implemented additional email filtering. The team is now considering whether to close the incident. Which factor is most important to consider before closing?

   • AWhether the phishing emails have been deleted from all mailboxes.
   • BWhether the executives have been notified of the incident.
   • CWhether the attacker had access to other systems using the compromised email accounts.
   • DWhether the email filtering rules have been tested and are working.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A multinational company is responding to a worm that spreads through a vulnerable network service. The worm is actively infecting Windows servers in multiple regions. The security team has a reliable patch, but deploying it to all servers will take several hours. Meanwhile, the worm continues to spread. What is the most effective immediate containment strategy?

   • ADeploy the patch to all servers as quickly as possible, accepting the continued spread.
   • BShut down all affected servers immediately.
   • CSegment the network and block the vulnerable service port at the perimeter and between segments.
   • DDisconnect all servers from the network and patch them one by one.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   After a ransomware attack, the team has restored all systems from backups. However, the backups were taken before the company implemented multi-factor authentication (MFA). The attacker had compromised a user account. What is the most important action to prevent a similar attack in the future?

   • ARestore the systems again from the same backups to ensure they are clean.
   • BChange the compromised user's password and close the incident.
   • CImplement MFA on all user accounts and verify that it is enforced before closing the incident.
   • DIncrease the frequency of backups to reduce future data loss.
   Reveal Solution Discussion Select an answer first