Incident Response and Handling CCOA Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   Which factor is most important when deciding between isolating a critical production server versus simply segmenting the network around it?

   • AThe number of users in the organization
   • BThe business impact of taking the server offline
   • CThe server's hostname
   • DThe color of the server's rack
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An incident responder is collecting evidence from a compromised server. The responder has made a forensic image of the hard drive. What should the responder do next to maintain the chain of custody?

   • ADelete the original hard drive contents to prevent further spread.
   • BAnalyze the image immediately to identify the malware.
   • CReturn the hard drive to the system administrator for reuse.
   • DDocument the hash value of the image and store the image in a secure location.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company has just completed the lessons learned phase of an incident response. What should the company do with the findings from the lessons learned review?

   • AUpdate the incident response plan and implement improvements to prevent future incidents.
   • BFile the report and move on to other tasks.
   • CDelete the report to avoid legal liability.
   • DShare the findings only with the incident response team.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   An analyst discovers malware on a non-critical file server that is not currently causing harm. Which containment approach is most appropriate?

   • ADo nothing and monitor
   • BImmediate eradication of the malware
   • CNetwork isolation of the server
   • DImmediate physical disconnection of the server
   Reveal Solution Discussion Select an answer first