Incident Response Triage GLIR Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   You are performing an initial assessment of a Linux incident. The affected server is a development server that is not in production. The server has been compromised, but the attacker only accessed a test database with no sensitive data. However, the server is connected to the corporate network. What is the MOST important factor in determining the urgency of this incident?

   • AThe time of day the compromise occurred
   • BThe potential for lateral movement from the development server to production systems
   • CThe fact that the server is not in production
   • DThe absence of sensitive data on the test database
   Reveal Solution Discussion Select an answer first
2. 42expert · hard · select all that apply

   You are responding to a Linux incident and need to identify potential evidence sources. The server is still running. Which of the following are volatile evidence sources that should be captured before powering off the system? Select all that apply.

   • AThe contents of /var/log/syslog
   • BThe /etc/shadow file
   • CThe system's ARP cache
   • DNetwork connections and open ports
   • ERunning processes and their command lines
   Check answers Discussion Select an answer first
4. 43expert · hard

   Your organization has a limited incident response team. You have three active incidents: (1) a Linux web server that is defaced, (2) a Linux database server that is sending outbound traffic to a known C2 IP, and (3) a Linux file server that has a suspicious cron job. The web server is public-facing, the database server is internal but contains sensitive customer data, and the file server is internal with no internet access. Which incident should you prioritize?

   • AThe database server, because it contains sensitive data and is communicating with a C2 IP
   • BThe web server, because it is public-facing and defaced
   • CAll three equally, because they are all potential threats
   • DThe file server, because it has a suspicious cron job
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   During triage, a responder must allocate limited resources to multiple incidents. Which approach best aligns with triage goals?

   • AFocus only on incidents that are easy to resolve.
   • BAssign equal resources to every incident to ensure fairness.
   • CPrioritize incidents based on criticality, impact, and likelihood.
   • DInvestigate incidents in the order they were reported.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A Linux server hosting a customer-facing web application is reported to be responding slowly. The on-call engineer notices a high number of outbound connections from the server to an external IP on port 443 and a recently modified cron job that downloads and executes a script. The server also has a large amount of free disk space and normal memory usage. You are the incident responder performing triage. What should be your FIRST priority?

   • APreserve the current state of the server by capturing memory and creating a forensic image of the disk
   • BRun a full antivirus scan on the server to identify the malware
   • CReboot the server to clear the malicious process from memory
   • DImmediately block the outbound IP address at the firewall to stop the data exfiltration
   Reveal Solution Discussion Select an answer first