Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 5)

Questions 21–25

1. 21application · easy

   A security analyst is reviewing logs and notices that an external entity has been scanning the company's public-facing web server for common vulnerabilities and has also been monitoring the company's social media pages for employee information. Which phase of the cyber kill chain does this activity represent?

   • AReconnaissance
   • BInstallation
   • CWeaponization
   • DDelivery
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which activity is part of the recovery phase after an incident?

   • ABlocking the attacker's IP address
   • BConducting a root cause analysis
   • CDeleting malicious files
   • DRestoring systems from clean backups
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During incident response, an analyst discovers that a workstation has been communicating with a known malicious IP address. The workstation is used by the CEO and contains sensitive documents. The analyst needs to contain the threat without disrupting the CEO's work. What is the most appropriate action?

   • AKill the process communicating with the IP
   • BBlock the malicious IP at the firewall and monitor the workstation
   • CIgnore the alert because the IP is not on a blocklist
   • DDisconnect the workstation from the network
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is conducting a threat assessment and wants to understand what information an attacker could gather about their organization without directly interacting with their systems. Which technique would provide this information?

   • AAttempting to log in to the organization's VPN with default credentials
   • BSearching public job postings for technology stack details
   • CSending phishing emails to employees to gather credentials
   • DScanning the organization's external IP range for open ports
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company experiences a data breach where an attacker exfiltrated data over several months. The incident response team is in the containment phase. They have identified the command-and-control server and the affected systems. However, the attacker has established persistence via multiple mechanisms, and the business cannot afford prolonged downtime. What is the best containment strategy?

   • AImmediately reimage all affected systems from known-good backups
   • BBlock the command-and-control server at the firewall and isolate affected systems
   • CDisconnect the affected systems from the network but keep them running for forensic analysis
   • DShut down the affected systems and restore from backups
   Reveal Solution Discussion Select an answer first