Incident Response and Forensics CISA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company has just experienced a significant security incident. The incident response team is in the containment phase and has isolated the affected systems. However, the team is under pressure from management to restore services quickly. The team suspects the attacker may have established persistence mechanisms. What is the most appropriate course of action?

   • AProceed to eradication to remove persistence mechanisms before recovery
   • BRestore services immediately to minimize business impact
   • CKeep the systems isolated indefinitely until all evidence is analyzed
   • DSkip eradication and go directly to lessons learned
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which forensic tool is commonly used to create a forensic image of a storage device?

   • AWireshark
   • BFTK Imager
   • CMetasploit
   • DNmap
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which legal consideration is MOST relevant when a forensic investigation involves data stored in another country?

   • AChain of custody
   • BJurisdictional issues
   • CForensic imaging techniques
   • DIncident classification
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   A security analyst identifies a malware infection on a single workstation and a suspected data breach of a customer database. Which incident should be prioritized for response?

   • ABoth should be handled simultaneously, regardless of resources
   • BThe data breach, because it likely has higher impact on the organization
   • CThe malware infection, because it is easier to contain
   • DThe malware infection, because it was detected first
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security operations center (SOC) receives an alert about a potential data breach. The alert is based on a new detection rule that has not been fully tested. The SOC manager must decide whether to escalate the alert to the incident response team. What is the most appropriate decision?

   • AWait for the rule to be tested before taking any action
   • BDo not escalate because the rule is untested and likely a false positive
   • CPerform a quick triage to validate the alert before deciding to escalate
   • DEscalate immediately because all alerts should be treated as incidents
   Reveal Solution Discussion Select an answer first