Incident Response and Post Incident Analysis CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   After a security incident, the response team notes that the intrusion was not detected for several days because the monitoring tool was not configured to alert on the specific attack pattern. What is the most appropriate improvement to recommend?

   • AReplace the monitoring tool with a different vendor
   • BDisable the monitoring tool to avoid false positives
   • CIncrease the frequency of penetration tests
   • DUpdate the monitoring tool's detection rules and alerting thresholds
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security tester discovers a suspicious process running on a production server during a scheduled penetration test. The tester immediately reports it to the incident response team. The team needs to preserve evidence while continuing to monitor the attacker's actions. Which action should the tester take to best support the incident response process?

   • AImmediately disconnect the server from the network to prevent further damage.
   • BCapture a memory dump and a network capture, then continue monitoring without terminating the process.
   • CTake a memory dump of the server and then terminate the suspicious process.
   • DReboot the server to clear the suspicious process and then collect disk images.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which practice is essential when collecting digital evidence to ensure its admissibility in legal proceedings?

   • AStoring evidence on the same server it came from
   • BDeleting irrelevant files to save space
   • CMaintaining a chain of custody
   • DUsing the original system for analysis
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security tester is preparing a post-incident report for a distributed denial-of-service (DDoS) attack. The report will be shared with senior management. What is the most important element to include for this audience?

   • AThe command-line commands used to mitigate the attack.
   • BA list of all security tools that were not used during the incident.
   • CThe exact IP addresses of the attack sources.
   • DA summary of the business impact and the effectiveness of the response.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security tester is writing a post-incident report after a malware infection. The report will be used to improve the organization's incident response process. What should the report include?

   • AA detailed account of what happened, the response actions, and lessons learned.
   • BA summary of the costs incurred during the incident response.
   • CA list of employees who were affected by the malware.
   • DOnly the technical details of the malware and how it was removed.
   Reveal Solution Discussion Select an answer first