Incident Response Triage GLIR Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company experiences a phishing email that led to a compromised account. The account has access to sensitive data. Which factor should be most heavily weighted in prioritizing this incident?

   • AThe time of day the phishing email was sent.
   • BThe email client used by the recipient.
   • CThe sensitivity of the data accessible by the compromised account.
   • DThe number of employees who received the phishing email.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   During initial assessment of a Linux incident, which factor is MOST important for determining the urgency of the response?

   • AThe age of the operating system
   • BThe analyst's familiarity with Linux
   • CThe number of log files available
   • DThe potential impact on business operations
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an example of volatile evidence that should be collected early during a Linux incident?

   • ALog files in /var/log
   • BThe system's hostname
   • CContents of RAM
   • DFiles in /etc
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which criterion is commonly used to prioritize incidents during triage?

   • AThe number of users logged in at the time
   • BThe color of the system's case
   • CCriticality of the affected system
   • DThe operating system's default wallpaper
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which practice is essential for maintaining chain of custody of digital evidence?

   • AAllowing all team members to freely copy evidence
   • BDeleting original files after analysis
   • CStoring evidence in a publicly accessible location
   • DDocumenting every person who handles the evidence and when
   Reveal Solution Discussion Select an answer first