Incident Response and Handling CCOA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which action is essential for preserving the integrity of digital evidence?

   • ADeleting duplicate files to save space
   • BCopying the evidence to a shared network drive
   • CViewing the evidence on the original system
   • DCreating a cryptographic hash of the evidence
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which containment strategy involves removing an affected system from the network to prevent further communication with other hosts?

   • ARecovery
   • BEradication
   • CIsolation
   • DSegmentation
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is responding to a security incident that involves a data breach. The incident response team is working with external legal counsel and a public relations firm. The CEO wants to issue a public statement about the breach. What should the incident response team do?

   • AAdvise the CEO to delay any public statement until the investigation is complete.
   • BDraft the public statement themselves and send it to the media.
   • CProvide the CEO with the facts of the incident and coordinate with legal counsel before any public statement.
   • DRefuse to provide any information to the CEO until the incident is fully resolved.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is it important to document all actions taken during an incident response?

   • ATo hide mistakes from management
   • BTo replace the need for communication
   • CTo provide a clear record for analysis and legal purposes
   • DTo slow down the response process
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst detects a malware infection on a server that is part of a cluster providing a critical web service. The malware is spreading to other servers in the cluster. The analyst needs to contain the infection while minimizing downtime for the web service. Which containment action is most appropriate?

   • ATake a memory dump of the infected server, then disconnect it.
   • BShut down the entire cluster to prevent the malware from spreading.
   • CApply a firewall rule to block traffic from the infected server to other servers.
   • DDisconnect the infected server from the network and let the other servers handle the load.
   Reveal Solution Discussion Select an answer first