Incident Response Triage GLIR Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small organization has a single Linux server that hosts both a public web server and an internal file share. The server is showing signs of compromise. The incident responder has limited time and must decide how to proceed. What is the BEST approach to triage this incident?

   • AImmediately disconnect the server from the network to stop the spread
   • BRun a vulnerability scanner to identify the attack vector
   • CReboot the server to clear any malicious processes
   • DPreserve volatile data and create a disk image before any other action
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   You are preserving evidence from a Linux server that was compromised. You have created a forensic image of the disk and captured memory. You need to maintain the chain of custody. Which of the following actions is the MOST important to ensure the evidence is admissible in court?

   • ADocumenting who had access to the evidence and when
   • BUsing the latest forensic software version
   • CStoring the evidence on a RAID array
   • DEncrypting the evidence files
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In incident triage, what does the 'likelihood' criterion assess?

   • AThe probability of successful prosecution
   • BThe probability that the alert represents a real threat
   • CThe chance that the system will crash
   • DThe number of false positives in the past
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   You are documenting your triage findings for a Linux incident. You have identified the affected systems, the indicators of compromise, and the actions you have taken so far. What additional information is essential to include in your triage documentation to ensure it is clear and reproducible?

   • AThe exact commands you ran and the output they produced
   • BThe brand and model of the forensic tools used
   • CThe IP addresses of all internal servers
   • DThe names of the users who reported the incident
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A security team is triaging a suspected intrusion. They have limited staff and must decide whether to investigate a potential data exfiltration from a web server or a ransomware infection on a file server. The web server is internet-facing and the file server contains critical business data. Which decision best balances impact and resource allocation?

   • AInvestigate the file server first because it contains critical business data and the impact of ransomware is likely higher.
   • BSplit the team to investigate both simultaneously.
   • CInvestigate the web server first because it is internet-facing and more likely to be attacked.
   • DWait for more information before deciding.
   Reveal Solution Discussion Select an answer first