Incident Response and Handling CCOA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has just experienced a security incident. The incident response team has contained the threat and eradicated the malware. The team is now in the process of restoring systems to normal operation. According to the incident handling lifecycle, what should the team do after completing the recovery phase?

   • AConduct a lessons learned review and update incident response procedures.
   • BImmediately close the incident and move on to other tasks.
   • CRestore all systems from backup and verify data integrity.
   • DNotify law enforcement and regulatory bodies.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An incident responder is handling a malware infection on a laptop that is connected to the corporate network. The laptop contains sensitive data and is used by a sales representative. The responder needs to contain the infection while preserving evidence for analysis. Which action should the responder take?

   • APower off the laptop to stop the malware from running.
   • BDisconnect the laptop from the network and leave it powered on.
   • CRun a malware removal tool on the laptop.
   • DReimage the laptop from a known-good backup.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During incident response, an analyst discovers that an attacker has been using PowerShell to run malicious scripts on a compromised workstation. The analyst needs to contain the incident while preserving evidence for a potential legal case. Which action best achieves both goals?

   • ADisconnect the workstation from the network and leave it powered on.
   • BRun a full antivirus scan on the workstation to remove the malicious scripts.
   • CReimage the workstation from a known-good backup.
   • DPower off the workstation immediately to prevent further malicious activity.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During containment implementation, why is it important to preserve evidence?

   • ATo ensure the incident is not reported to management
   • BTo allow for later analysis and potential legal action
   • CTo speed up the recovery process
   • DTo prevent the attacker from accessing the system
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security operations center receives three incident alerts simultaneously. Alert 1: A single workstation has been infected with adware. Alert 2: A database server is being accessed by an unauthorized IP address, and the server contains sensitive customer data. Alert 3: A phishing email has been reported by one user, but no one has clicked the link. The team has limited resources. Which incident should be prioritized first?

   • AThe unauthorized access to the database server.
   • BAll incidents should be handled simultaneously.
   • CThe adware infection on the workstation.
   • DThe phishing email report.
   Reveal Solution Discussion Select an answer first