Incident Response Triage GLIR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An incident responder is performing an initial assessment of a potential data breach. The only indicator is a single alert about unusual database queries. What should the responder do to determine scope and impact?

   • AIsolate the database server from the network to prevent further queries.
   • BImmediately notify law enforcement based on the single alert.
   • CCorrelate the alert with other logs and system activity to identify additional indicators.
   • DReset all user passwords to mitigate potential unauthorized access.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your organization has three Linux servers that have triggered alerts. Server A is a public-facing web server that is part of the DMZ and has been sending outbound traffic to a known command-and-control IP. Server B is an internal file server with no internet access that has a failed login attempt from an internal user. Server C is a development server that is not in production and has a high CPU usage alert. You have limited resources and can only investigate one server at a time. Which server should you prioritize?

   • AServer A, because it is public-facing and shows signs of compromise with outbound C2 traffic
   • BServer B, because it is an internal file server and may contain sensitive data
   • CServer C, because high CPU usage may indicate a resource issue
   • DInvestigate all three simultaneously to save time
   Reveal Solution Discussion Select an answer first
4. 13application · medium · select all that apply

   A Linux server is suspected of being compromised. Which of the following are appropriate evidence sources to collect during triage? Select all that apply.

   • AFilesystem artifacts
   • BSystem logs
   • CHardware inventory
   • DMemory dump
   • ENetwork traffic captures
   Check answers Discussion Select an answer first
5. 14expert · medium

   A security team has two incidents: a low-likelihood but high-impact attack on a critical server, and a high-likelihood but low-impact attack on a non-critical server. Which incident should be prioritized?

   • AThe high-likelihood attack on the non-critical server, because it is more likely to occur.
   • BThe high-impact attack on the critical server, because impact outweighs likelihood.
   • CBoth equally, because they balance each other out.
   • DNeither, until more information is available.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a potential source of digital evidence on a Linux system?

   • ASystem logs such as /var/log/auth.log
   • BThe monitor's refresh rate
   • CThe physical keyboard layout
   • DThe system's power supply unit
   Reveal Solution Discussion Select an answer first