Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the main purpose of the post-incident activity phase in the incident response lifecycle?

   • ATo identify the root cause and improve future response capabilities
   • BTo detect and analyze the incident
   • CTo restore systems to normal operation
   • DTo contain the incident and prevent further damage
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A threat intelligence feed reports that a known APT group is using a specific phishing lure that drops a unique DLL loader. The feed includes the SHA256 hash of the loader and the subject line of the phishing email. How should the security team use this intelligence to improve detection?

   • ABlock all inbound email from the internet
   • BDisable the DLL loader on all endpoints
   • CWait for the APT group to be arrested
   • DCreate a SIEM correlation rule that alerts on the DLL hash and email subject line
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which containment strategy is most appropriate for a single infected workstation that is not critical to business operations?

   • AImmediately reimage the workstation without preserving evidence
   • BIsolate the workstation from the network
   • CShut down the entire network
   • DLeave the workstation connected to monitor the attacker's activity
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst notices that an external IP has been performing DNS lookups for the company's internal hostnames (e.g., dc01.internal.company.com) and has also queried the company's public WHOIS records. No successful authentication has occurred. Which type of activity does this represent?

   • AActive reconnaissance using DNS enumeration and WHOIS queries
   • BInitial exploitation attempt
   • CCommand and control beaconing
   • DPassive reconnaissance using OSINT sources
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does threat intelligence primarily inform the reconnaissance phase of an attack?

   • ABy automating the containment of threats
   • BBy providing legal guidance for incident reporting
   • CBy providing indicators of compromise to detect active attacks
   • DBy identifying the adversary's tactics, techniques, and procedures (TTPs)
   Reveal Solution Discussion Select an answer first