Incident Handling & Response GSEC Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An incident responder needs to collect evidence from a compromised Linux server. The server is still running, and the responder wants to preserve volatile data. Which type of data should be collected FIRST?

   • AThe list of open files
   • BThe system's memory (RAM)
   • CThe system logs
   • DThe contents of the hard drive
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   After a ransomware incident, the incident response team has contained the spread and collected forensic images of affected servers. The company wants to restore operations as quickly as possible. Which step should be performed BEFORE restoring systems from backup?

   • AChange all user passwords in the organization
   • BDisconnect all systems from the internet
   • CNotify law enforcement of the incident
   • DIdentify and eliminate the root cause of the initial compromise
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After removing a web shell from a compromised web server, the incident response team wants to ensure the server is clean before returning it to production. Which step is MOST critical in the eradication phase?

   • ADelete the web shell file and restart the web service
   • BUpdate the antivirus definitions and run a scan
   • CChange the administrator password on the server
   • DRebuild the server from a known-good image
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company has detected a worm that is spreading across its internal network. The worm exploits a vulnerability in a legacy application that cannot be patched immediately. The incident response team must contain the worm while maintaining business operations. Which containment strategy is most effective?

   • AApply a host-based firewall rule to block the worm's communication ports on all affected systems.
   • BShut down all servers running the legacy application.
   • CIsolate the affected systems and use a network access control (NAC) solution to block unpatched devices.
   • DSegment the network by disabling the vulnerable application's ports at the switches.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company has experienced a ransomware attack that encrypted critical files. The incident response team has restored the files from backups and is now preparing a communication plan. The CEO wants to reassure customers that their data is safe, but the investigation has not yet confirmed whether customer data was exfiltrated. Which communication approach is most appropriate?

   • ADelay all communication until the investigation is complete.
   • BProvide customers with the technical details of the ransomware variant to reassure them.
   • CState that the company is investigating the incident and will provide updates as more information becomes available.
   • DIssue a statement that customer data was not affected, based on the lack of evidence of exfiltration so far.
   Reveal Solution Discussion Select an answer first