2.3 - Understand Incident Response CC Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   A security analyst detects unusual outbound data transfers from a database server. The analyst suspects a data exfiltration attack. The incident response plan says to preserve evidence, but the business wants to keep the server online to avoid downtime. Which action best balances the need for evidence preservation with the need to stop the exfiltration?

   • ALeave the server online and monitor the traffic to gather more evidence
   • BDisconnect the server from the network and then power it off
   • CPower off the server immediately to preserve evidence
   • DIsolate the server from the network while keeping it powered on to preserve volatile evidence
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the first step in developing an incident response plan?

   • ATest the plan
   • BEstablish procedures
   • CAssign resources
   • DDefine the scope of the plan
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which activity is part of incident detection and analysis?

   • AMonitoring network traffic for suspicious activity
   • BConducting a post-incident review
   • CDeleting malware from infected systems
   • DRestoring systems from backup
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of incident response in an organization?

   • ATo prevent all security incidents from occurring by implementing strong access controls
   • BTo identify and prosecute the individuals responsible for security incidents
   • CTo replace business continuity planning by providing a rapid recovery process
   • DTo detect, respond to, and recover from security incidents in a timely and effective manner to minimize impact
   Reveal Solution Discussion Select an answer first