An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

• A.Take a snapshot of the compromised server and verify its integrity
• B.Restore the affected server to remove any malware
• C.Contact the appropriate government agency to investigate
• D.Research the malware strain to perform attribution

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the most important factor to ensure accurate incident response reporting?

• A.A well-defined timeline of the events
• B.A guideline for regulatory reporting
• C.Logs from the impacted system
• D.A well-developed executive summary

Comment: *

Name: *

Email: *

Verification: *

An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

• A.Disable the user's network account and access to web resources
• B.Make a copy of the files as a backup on the server.
• C.Place a legal hold on the device and the user's network share.
• D.Make a forensic image of the device and create a SRA-I hash.

Comment: *

Name: *

Email: *

Verification: *

An incident response team member is triaging a Linux server. The output is shown below:

Which of the following is the adversary most likely trying to do?

• A.Create a backdoor root account named zsh.
• B.Execute commands through an unsecured service account.
• C.Send a beacon to a command-and-control server.
• D.Perform a denial-of-service attack on the web server.

Comment: *

Name: *

Email: *

Verification: *

Which of the following best describes the actions taken by an organization after the resolution of an incident that addresses issues and reflects on the growth opportunities for future incidents?

• A.Scrum review
• B.Regulatory compliance
• C.Root cause analysis
• D.Lessons learned

Comment: *

Name: *

Email: *

Verification: *