Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which statement best describes the role of reconnaissance in the cyber kill chain?

   • AIt is the phase where the adversary gains initial access to the target
   • BIt is the first phase that enables the adversary to identify and select targets
   • CIt is an optional step that only advanced adversaries perform
   • DIt is the final phase where the adversary achieves the objective, such as data exfiltration
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security analyst is investigating a potential breach and has identified a suspicious file hash, an unusual outbound connection, and a modification to a system registry key. The analyst wants to determine if these are indicators of compromise (IOCs) or false positives. Which approach is most effective?

   • AIgnore the indicators because they are not on the known IOC list
   • BImmediately block the file hash and IP address
   • CCorrelate the indicators with threat intelligence and analyze the context of the activity
   • DRebuild the system from backup to ensure it is clean
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What should be included in an incident report to be useful for future response efforts?

   • APersonal opinions about team members
   • BA detailed timeline of events and actions taken
   • CThe names of all employees involved
   • DOnly the final outcome of the incident
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An organization detects a ransomware outbreak that has encrypted files on several workstations. The malware is spreading laterally via SMB. The incident response team wants to contain the outbreak while preserving the ability to investigate the initial infection vector. Which containment strategy is most appropriate?

   • ARestore the workstations from backup immediately
   • BIsolate the affected workstations from the network but keep them powered on
   • CPower off the affected workstations immediately
   • DDisable SMB on the entire network
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   After a ransomware incident, the incident response team has identified the initial entry vector as a phishing email with a malicious attachment. The team has removed the malware from all affected systems and restored data from backups. What should the team do next to ensure the threat is fully eradicated?

   • AIdentify and remediate the root cause, such as the phishing email and any associated persistence mechanisms
   • BNotify law enforcement and regulatory bodies
   • CDisable the user accounts that opened the phishing email
   • DScan all systems with updated antivirus software
   Reveal Solution Discussion Select an answer first