6.2 Explain the Process and Outcomes of Incident Response CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–14

1. 11application · medium

   A security analyst detects a workstation beaconing to a known command-and-control domain. The workstation is a domain-joined Windows machine used by the finance team. The analyst needs to stop the immediate threat while preserving evidence for later analysis. Which action should the analyst take first?

   • AIsolate the workstation by disabling its network adapter via Group Policy.
   • BReboot the workstation to clear the malicious process from memory.
   • CDisconnect the workstation from the network and take a memory image.
   • DRun an antivirus scan on the workstation to identify the malware.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center (SOC) analyst receives an alert from the endpoint detection and response (EDR) tool about a suspicious PowerShell command executed on a server. The analyst needs to determine whether this is a true positive or a false positive. Which action is most appropriate during the detection and analysis phase?

   • AReview the process tree and command-line arguments associated with the alert.
   • BSearch the internet for the exact command line to see if it is known malware.
   • CImmediately isolate the server from the network.
   • DDisable PowerShell on the server to prevent further abuse.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which outcome of incident response is achieved when affected systems are restored to normal operation and validated as functional?

   • AEradication
   • BPost-incident analysis
   • CRecovery
   • DContainment
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During which phase of the incident response process does the team focus on limiting the scope and impact of an ongoing security incident?

   • ARecovery
   • BContainment
   • CDetection
   • DPreparation
   Reveal Solution Discussion Select an answer first