QUESTION: 17

An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

Host a discovery meeting and define configuration and policy updates
Update the IDS/IPS signatures and reimage the affected hosts
Identify the systems that have been affected and tools used to detect the attack
Identify the traffic with data capture using Wireshark and review email filters

Answer(s): C

Reveal Solution Next Question

An engineer is going through vulnerability triage with company management because of a recent malware outbreak from which 21 affected assets need to be patched or remediated. Management decides not to prioritize fixing the assets and accepts the vulnerabilities. What is the next step the engineer should take?

Investigate the vulnerability to prevent further spread
Acknowledge the vulnerabilities and document the risk
Apply vendor patches or available hot fixes
Isolate the assets affected in a separate network

Answer(s): D

Reveal Solution Next Question

QUESTION: 19

The incident response team receives information about the abnormal behavior of a host. A malicious file is found being executed from an external USB flash drive. The team collects and documents all the necessary evidence from the computing resource. What is the next step?

Conduct a risk assessment of systems and applications
Isolate the infected host from the rest of the subnet
Install malware prevention software on the host
Analyze network traffic on the host’s subnet

Answer(s): B

Reveal Solution Next Question

QUESTION: 20 DRAG DROP

An engineer notices that unauthorized software was installed on the network and discovers that it was installed by a dormant user account. The engineer suspects an escalation of privilege attack and responds to the incident. Drag and drop the activities from the left into the order for the response on the right.

Select and Place:

Exhibit A:

Exhibit B:

Please refer to Exhibit B for the answer.

Answer(s): A

Reveal Solution Next Question

Free 350-201 Exam Braindumps (page: 6)

QUESTION: 17

QUESTION: 18

QUESTION: 19

QUESTION: 20 DRAG DROP

350-201 Discussions & Posts