Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   After containing an incident, the incident response team needs to communicate the scope to executives. What is the most important information to include in this communication?

   • AThe technical details of the malware's code
   • BA list of all affected systems, data, and users, along with the timeline
   • CThe names of the analysts who performed the investigation
   • DThe exact commands used by the attacker
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which of the following is an output of the incident scoping process?

   • AA business continuity plan
   • BA list of compromised hosts and accounts
   • CA list of security policies
   • DA vulnerability scan report
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A SIEM receives logs from multiple sources in different formats. The analyst wants to search for all failed logins across Windows, Linux, and firewall logs. The logs use different field names (e.g., 'EventID', 'message', 'action'). What is the most efficient way to enable a single search?

   • AUse a regex query that matches all possible field names
   • BSearch each source separately and manually combine results
   • CConvert all logs to PDF and use text search
   • DConfigure the SIEM's parsing rules to normalize fields into a common schema
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   An organization has EDR on all endpoints but not on servers. During an incident, they suspect a server is compromised. The EDR on endpoints shows that a workstation connected to the server via RDP. What is the most important next step to scope the incident?

   • ARely on network flow logs to determine if the server exfiltrated data
   • BCheck the server's local logs (e.g., Security, System, PowerShell) for suspicious activity
   • CAssume the server is not compromised because the EDR did not alert
   • DIsolate the server immediately without further investigation
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   An incident responder is investigating a possible insider threat. The user is suspected of accessing sensitive files on a file server and then emailing them externally. Which combination of data sources would provide the most complete evidence of this activity?

   • AVulnerability scan reports for the file server
   • BEDR logs from the user's workstation only
   • CFirewall logs and DNS logs only
   • DFile server audit logs, email gateway logs, and authentication logs
   Reveal Solution Discussion Select an answer first