Incident Handling & Response GSEC Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   During a malware outbreak, the incident response team disconnects affected systems from the network to prevent the malware from spreading. Which containment strategy is being used?

   • ADecommissioning
   • BIsolation
   • CPatching
   • DMonitoring
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst at a hospital discovers that a medical device is communicating with an unknown external IP address. The device is critical for patient monitoring, and disconnecting it could endanger patients. The analyst must determine whether this is a security incident and how to respond. Which action is most appropriate?

   • ABlock the external IP address at the firewall while allowing the device to continue operating.
   • BMonitor the communication and gather more information before taking action.
   • CImmediately disconnect the device from the network to stop the communication.
   • DConsult with the device manufacturer and clinical staff to assess the risk and determine the appropriate response.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which output is a typical result of a post-incident review?

   • AUpdated incident response plan
   • BA list of affected customers
   • CA backup of the affected systems
   • DNew malware signatures
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst at a mid-sized firm notices a spike in failed authentication attempts against the VPN gateway, followed by a single successful login from an unfamiliar IP address. The analyst must determine whether this is a security incident and, if so, how to prioritize it. The company has no formal incident response plan, and the CISO is unavailable. Which action should the analyst take first?

   • AContact the user whose account was used and ask if they recognize the login.
   • BEscalate directly to the CISO and wait for instructions before taking any further action.
   • CReview the VPN logs and correlate the failed attempts with the successful login to assess whether the account was compromised.
   • DIsolate the VPN gateway from the network to prevent further access.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a data breach, the incident response team discovers that sensitive customer data was exfiltrated. The CEO wants to notify affected customers immediately, but the legal counsel advises waiting until the investigation is complete. Which communication approach best balances transparency and legal risk?

   • AWait until the investigation is complete and then issue a detailed public statement.
   • BNotify customers immediately with the limited information available.
   • CIssue a vague statement that acknowledges an incident but provides no specifics.
   • DCommunicate with legal and public relations to craft a message that discloses known facts while protecting ongoing investigation details.
   Reveal Solution Discussion Select an answer first