Incident Response and Business Continuity GSLC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   When collecting digital evidence, which of the following is the most important action to preserve its integrity?

   • ACopy only the relevant files to a USB drive
   • BDelete any malicious files found
   • CCreate a forensic image of the original media
   • DTurn on the system and explore the files
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company has detected a sophisticated attacker who has gained access to a critical application server. The attacker is actively exfiltrating data. The incident response team has been activated. The incident commander must decide on a containment strategy. The company has a legal obligation to preserve evidence for potential prosecution. Which containment strategy BEST balances the need to stop the exfiltration with the need to preserve evidence?

   • ABlock the attacker's IP address at the firewall, but allow the attacker to continue accessing the server.
   • BAllow the attacker to continue exfiltrating data to gather more evidence about their methods.
   • CDisconnect the server from the network to immediately stop the exfiltration, while preserving the server's memory and disk for forensic analysis.
   • DShut down the server immediately to stop the exfiltration and preserve the evidence.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is developing its business continuity plan (BCP). The BCP team has completed a business impact analysis (BIA) and identified the critical functions of the organization. Which step should the BCP team take NEXT?

   • APurchase backup hardware and software for all critical systems.
   • BConduct a full-scale exercise to test the plan.
   • CDevelop continuity strategies and recovery objectives for each critical function.
   • DTrain all employees on their roles in the plan.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a typical outcome of a post-incident review?

   • AImmediate dismissal of the incident response team
   • BNo changes to the incident response plan
   • CUpdated incident response procedures
   • DDeletion of all incident logs
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security operations center receives three simultaneous alerts: (1) a phishing email that was blocked by the gateway, (2) a workstation infected with ransomware that is encrypting files, and (3) a failed login attempt on a public-facing web server. According to incident triage principles, which alert should be handled FIRST?

   • AThe failed login attempt on the web server.
   • BAll three should be handled simultaneously.
   • CThe blocked phishing email.
   • DThe ransomware infection on the workstation.
   Reveal Solution Discussion Select an answer first