Incident Response and Post Incident Analysis CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A post-incident review of a data breach reveals that the security testing team did not include the breached application in its test scope because of a miscommunication with the development team. The security tester is asked to recommend improvements. Which recommendation would be most effective?

   • AEstablish a formal process for defining and communicating the scope of security tests.
   • BUse automated scanning tools to test all applications continuously.
   • CIncrease the number of security testers on the team.
   • DRequire the development team to perform their own security testing.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security tester is involved in the eradication phase of an incident response. The team has contained the incident and is now removing the attacker's presence from the system. What is the tester's role in this phase?

   • ADelete all logs to ensure the attacker cannot use them.
   • BDecide when the system is ready to be returned to production.
   • CVerify that the eradication steps do not miss any backdoors or persistence mechanisms.
   • DTake over the system administration tasks to ensure the system is secure.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of creating a forensic image (bit-for-bit copy) of a storage device during incident response?

   • ATo preserve the original evidence in an unaltered state
   • BTo reduce the storage space required for evidence
   • CTo allow multiple analysts to work on the same file simultaneously
   • DTo speed up the incident response process
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can a security test finding, such as an unexpected open port on a production server, contribute to incident detection?

   • AIt provides a baseline of normal behavior, making anomalies easier to spot.
   • BIt automatically blocks all traffic to that port.
   • CIt eliminates the need for monitoring tools.
   • DIt proves that an incident has occurred.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security tester is collecting evidence from a compromised web server. The tester wants to preserve the evidence in a way that is acceptable for legal proceedings. What should the tester do?

   • ADelete any irrelevant files to simplify the evidence set.
   • BDocument the chain of custody and store the evidence in a secure location.
   • CUse the original system to analyze the evidence.
   • DMake a copy of the evidence and share it with the legal team.
   Reveal Solution Discussion Select an answer first