6.1 Explain Security Operations Functions (e.g., Identify / Detect, Investigate, Mitigate, Improve) CYBERSECURITY-APPRENTICE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a security incident where an attacker exploited a weak password to gain access, the incident response team has completed the investigation and mitigation. What is the most appropriate Improve action?

   • AConduct a security awareness training session on password best practices.
   • BChange the passwords for all user accounts that were affected by the incident.
   • CReview the incident timeline to document what happened.
   • DImplement a multi-factor authentication policy for all user accounts.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which activity is part of the Improve function?

   • AConducting a post-incident review to identify areas for improvement.
   • BMonitoring network traffic for unusual patterns.
   • CCollecting forensic evidence from affected systems.
   • DQuarantining a malicious file detected on a server.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   Following a security incident where an employee's laptop was stolen, the incident response team completed the investigation and mitigation. During the post-incident review, the team identified that the laptop's hard drive was not encrypted. What is the most appropriate Improve action?

   • AImplement a policy requiring full-disk encryption on all company laptops.
   • BReplace the stolen laptop with a new one that has more RAM.
   • CConduct a background check on the employee who lost the laptop.
   • DIncrease the frequency of backups for all laptops.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is investigating a suspected data exfiltration incident. The analyst has identified that a large amount of data was transferred to an external IP address. The analyst must now determine the scope of the incident. Which action is most effective for the Investigate phase?

   • ANotify the data owner that their data may have been exfiltrated.
   • BBlock the external IP address at the firewall to prevent further data transfer.
   • CRestore the exfiltrated data from backups to ensure data availability.
   • DCorrelate the data transfer logs with authentication logs to identify which user accounts were involved.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has detected a sophisticated attack that has compromised a server. The incident response team has confirmed the attack and is now deciding on the best Mitigate strategy. The team has identified that the attacker has established persistence mechanisms on the server. What is the most effective Mitigate action?

   • AIsolate the server from the network and rebuild it from a known-good image.
   • BChange the server's administrator password to prevent the attacker from accessing it.
   • CDisconnect the server from the network and monitor for further activity.
   • DRemove the malware from the server using an antivirus tool.
   Reveal Solution Discussion Select an answer first