Incident Handling & Response GSEC Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A SOC receives two alerts simultaneously: (1) a single workstation has a known malware signature detected by antivirus, and (2) a domain controller has failed login attempts from multiple external IP addresses. The SOC has limited staff. Which alert should be investigated FIRST?

   • ABoth alerts simultaneously, splitting the staff
   • BNeither alert, until more data is collected
   • CThe domain controller alert, because it may indicate a brute-force attack on a critical system
   • DThe workstation malware alert, because it is a confirmed detection
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   After a security incident, the incident response team conducts a post-incident review. The team finds that the incident was prolonged because the incident commander did not have the authority to make critical decisions without consulting senior management. Which improvement should the team recommend?

   • ACreate a detailed incident response plan that includes step-by-step instructions for every possible scenario.
   • BIncrease the number of incident response team members to distribute decision-making.
   • CRequire senior management to be available 24/7 for incident decisions.
   • DEmpower the incident commander with pre-authorized decision-making authority for defined scenarios.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A financial services company's SOC receives an alert from its EDR platform: a single workstation in the accounting department has been beaconing to an external IP address every 5 minutes for the past 3 hours. The workstation's user is currently logged in and actively working. The company has a policy that requires minimizing business disruption while containing potential incidents. Which action should the SOC analyst take FIRST?

   • ADisable the user's account in Active Directory
   • BNotify the user and ask them to close all applications
   • CVerify the alert by checking the workstation's running processes and recent network connections
   • DIsolate the workstation from the network immediately
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security analyst is reviewing the incident handling process after a recent malware infection. The analyst notices that the team moved directly from detection to eradication without formally containing the incident. Which phase was skipped, and why is it important?

   • ARecovery, because it restores systems to normal operation
   • BContainment, because it limits the spread of the incident
   • CLessons learned, because it identifies improvements
   • DPreparation, because it ensures the team is ready to respond
   Reveal Solution Discussion Select an answer first