6.1 Explain Security Operations Functions (e.g., Identify / Detect, Investigate, Mitigate, Improve) CYBERSECURITY-APPRENTICE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC analyst is monitoring network traffic and notices a series of failed login attempts to a critical database server from an internal IP address. The attempts are increasing in frequency. According to the security operations functions, what is the analyst's primary responsibility at this point?

   • AIgnore the attempts because they are from an internal IP address and are not a threat.
   • BBlock the internal IP address at the firewall immediately to stop the attempts.
   • CReset the database server's administrator password to prevent unauthorized access.
   • DDetermine whether the failed attempts indicate a brute-force attack or a misconfigured application.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has experienced a ransomware attack that encrypted critical files on several servers. The incident response team has isolated the affected servers and is now in the recovery phase. The team has a backup strategy that includes daily backups, but the most recent backup is from 24 hours ago. What is the most important consideration for the Mitigate function during recovery?

   • AReimage the affected servers from scratch and reconfigure them with the same settings.
   • BRestore the most recent backup as quickly as possible to minimize data loss.
   • CEnsure the backup used for restoration is free of malware and was taken before the initial infection.
   • DPay the ransom to obtain the decryption key and restore the files.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After a security incident involving a successful brute-force attack on a VPN gateway, the incident response team has completed the containment and eradication phases. The team is now in the post-incident review. Which action is most aligned with the Improve function?

   • ADocumenting the incident timeline and the actions taken by the response team.
   • BUpdating the VPN gateway configuration to enforce account lockout after five failed attempts.
   • CDeleting the logs from the VPN gateway to free up storage space.
   • DConducting a vulnerability scan on the VPN gateway to identify other weaknesses.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an investigation, a security analyst discovers that a ransomware variant has encrypted files on three file servers and is attempting to spread to other servers. The analyst has already isolated the infected servers from the network. What is the next most appropriate Mitigate action?

   • AIdentify the ransomware variant and search for a decryption tool to restore the encrypted files.
   • BPower off the file servers and leave them offline until the investigation is complete.
   • CImmediately rebuild the file servers from scratch and reconfigure them with the same settings.
   • DRestore the encrypted files from the most recent backup without checking the backup for malware.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   During the Investigate phase of incident response, what is the primary goal?

   • ATo understand the scope and impact of the incident by analyzing evidence and correlating data.
   • BTo update the incident response plan based on lessons learned.
   • CTo immediately block all suspicious IP addresses.
   • DTo identify potential threats by monitoring network traffic.
   Reveal Solution Discussion Select an answer first