CCNA Incident Management Questions

The primary goals are to minimize business disruption and restore normal operations quickly. Assigning blame is not a goal; documenting steps is important but secondary; increasing budget is not a direct goal.

Options A and C are correct because identifying indicators of compromise and determining the scope of the incident are key to understanding the incident. Restoration, patching, and notification are later phases.

The exhibit shows a user account with administrative privileges being used from an unusual geographic location at an anomalous time, followed by lateral movement to a domain controller. This pattern indicates that the initial access was gained through a compromised account, which was then leveraged for privilege escalation to move laterally and access sensitive systems. The attack vector is the misuse of valid credentials, not an injection or social engineering attack.

Key components include a communication escalation matrix, defined roles and responsibilities, and a post-incident review process. Disaster recovery procedures are separate, and network diagrams are supporting but not a core component.

The call tree should have alternates; proceeding to the next person ensures continuity.

Option A is correct because documenting all actions taken during evidence collection ensures the integrity and admissibility of evidence in legal proceedings. This documentation, often referred to as a 'paper trail' or 'audit log,' must include timestamps, personnel involved, tools used, and any deviations from standard procedures. Without this, the chain of custody is weakened, and the evidence may be challenged as unreliable or tampered with.

The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.

Risk assessment starts with identification, then analysis, evaluation, treatment, and continuous monitoring.

Option D is correct because applying the patch addresses the root cause and prevents recurrence. Disciplining employees and reporting to law enforcement are secondary; lessons learned is post-recovery.

Options A and C are correct because URL/hash and sending IP are key IOCs for blocking and attribution. Option B is irrelevant; Option D may be useful but not IOCs; Option E is not an IOC.

The main goal of a post-incident review is to identify process improvements to prevent future incidents. Option B is correct.

The first priority in ransomware incident response is containment to prevent the encryption from spreading to other systems. Isolating the affected file server from the network (e.g., disabling the network interface or disconnecting the cable) stops the ransomware from communicating with its command-and-control server and encrypting additional shares. This aligns with the NIST SP 800-61 containment strategy and ensures that the incident response team can safely preserve forensic evidence before any remediation.

A clear chain of command and escalation procedures ensure that during an incident, decision-making authority and notification paths are predefined, reducing confusion and enabling rapid, coordinated response. This aligns with NIST SP 800-61 incident response guidelines, which emphasize the need for defined roles and communication hierarchies to avoid delays or missteps in critical situations.

During detection, the team activates the incident response team and collects/analyzes logs to confirm the incident. Root cause analysis occurs later, evidence preservation is during containment, and rebuilding is recovery.

The first step is to verify the alert and assess the scope to determine if it's a true positive and understand the impact.

Multiple unexpected system reboots (B) are a strong indicator of a potential security incident because they may result from malware, kernel-level exploits, or denial-of-service attacks that crash the operating system. Unusual outbound network traffic from a server (E) often indicates data exfiltration, command-and-control (C2) communication, or a compromised service sending sensitive data to an external host. Both behaviors deviate from baseline operations and warrant immediate investigation under the Incident Management domain.

The first step is to verify if the activity is legitimate or malicious to avoid false positives and understand the context.

The encrypted outbound traffic on port 443 (HTTPS) from a database server to an unknown IP is a classic indicator of data exfiltration. Attackers often use encrypted channels to bypass network security controls, as the contents of the traffic cannot be inspected by DLP or IDS/IPS systems. The database server is a high-value target for sensitive data, making this the most likely attack scenario.

The exhibit shows a user logging in from an unusual location, attempting unauthorized access, and then exfiltrating sensitive data. This pattern is indicative of an insider threat, as it involves a legitimate user performing malicious actions. Option A is correct.

The Communications Lead is responsible for notifying affected users about the phishing attack because this role manages external and internal communications, including user notifications, during an incident. In the exhibit, the Communications Lead is explicitly assigned the task of 'Notify affected users' under the communication plan, ensuring timely and accurate messaging to reduce further risk.

Option D is correct because the alternate team must first assess the situation to understand the scope, impact, and validity of the ransomware attack before activating the plan. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis precede containment, eradication, and recovery. Jumping directly to execution without assessment could lead to inappropriate response actions, such as isolating systems that are not affected or failing to preserve critical forensic evidence.

Before escalating or taking containment actions, the analyst should gather additional evidence to confirm the alert. Option D is correct.

Identifying indicators of compromise and determining the scope are critical during detection and analysis.

Containment is the first priority to prevent further damage. Eradication, recovery, and lessons learned come later.

B is correct because the post-incident phase is the appropriate time to notify external stakeholders such as law enforcement, as it occurs after containment and eradication are complete. During this phase, the incident is fully documented, evidence is preserved, and legal obligations (e.g., breach notification laws like GDPR Article 33 or HIPAA Breach Notification Rule) are fulfilled. Notifying law enforcement earlier could compromise forensic integrity or operational continuity, so it is deliberately deferred to the post-incident stage.

Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Isolating affected endpoints preserves volatile memory evidence needed to analyze fileless malware.

Correct: Limiting further damage (A) and preventing expansion (C) are containment goals. Eradication (B) is a separate phase. Preserving evidence (D) is important but not primary in containment, and restoring operations (E) is recovery.

Option C is correct because antivirus detection of a known malware signature is a definitive indicator. Options A and B are ambiguous. Option D is a potential threat but not an incident.

OSINT, industry information sharing groups, and vendor vulnerability databases are established threat intelligence sources. Social media posts from employees are unreliable, and internal network traffic logs are operational data, not threat intelligence.

Option D is correct because testing restored systems ensures functionality and no residual threats. Options A, B, C are steps that follow after validation.

A communication plan is essential because it defines how the incident response team will coordinate internally and notify external stakeholders such as regulators, law enforcement, customers, and the media. Without a predefined communication plan, critical updates may be delayed or mishandled, leading to regulatory penalties or reputational damage. This aligns with NIST SP 800-61 and CISM best practices for incident management.

Disabling the user account immediately stops any ongoing misuse of the compromised credentials, preventing the attacker from accessing additional resources. Option A is correct.

Options A, B, and E are correct because the plan should include team members, external contacts, and communication templates. Detailed procedures are in playbooks, not the plan itself. Budget is separate.

The exhibit shows multiple failed authentication attempts (Event ID 4625) from a single user account within a short time window, followed by a successful logon (Event ID 4624) and then an access event to a file share (Event ID 5140). This pattern of rapid, repeated failures culminating in a single success is characteristic of a brute-force attack, where the attacker guesses the password and then uses the compromised credentials to access a file server.

Volatile data, such as the contents of RAM, is lost when a system is powered off. The first priority during incident response is to capture this data because it contains running processes, network connections, encryption keys, and malware that exist only in memory. Collecting RAM first ensures that this critical evidence is preserved before any other actions that might alter the system state.

NIST SP 800-61 (Computer Security Incident Handling Guide) is the definitive U.S. government standard for incident response processes, covering preparation, detection, containment, eradication, and recovery. It provides detailed, step-by-step guidance for building an incident response plan, making it the primary reference for aligning with industry best practices.

Option C is correct because the first step in incident response is to validate the alert. The analyst must verify that the traffic is indeed anomalous and not legitimate (e.g., a large backup or software update) by examining logs and packet captures. Premature action without verification could disrupt business operations or destroy forensic evidence.

Option B is correct because the configuration indicates the standard playbook will be executed, the incident response team will be notified, and containment actions will be automatically applied. Priority override is false, so no override occurs.

Options A, C, and E are correct because roles and responsibilities, communication procedures, and evidence handling are fundamental. Detailed technical instructions are impractical, and pre-approved vendors are helpful but not core.

Unusual outbound traffic and unauthorized access to sensitive data are classic indicators of a data breach. Multiple failed logins may indicate brute force, spam relates to phishing, and performance degradation is too vague.

Disconnecting an infected workstation from the network is a classic containment action because it immediately isolates the compromised system, preventing the spread of malware or unauthorized lateral movement to other hosts. Containment focuses on limiting the scope and impact of an incident, not on remediation or investigation. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is performed before eradication and recovery.

Option C is correct because the first step is to investigate the target web server logs to determine if the XSS attempt was successful. Blocking the source IP or disabling the rule may be premature if the attack was not effective, and confirming a false positive is less direct than reviewing logs.

Updating the plan based on lessons learned and scheduling a follow-up test improves preparedness.

The correct answer is A because DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.

After containment and eradication, the priority is to preserve evidence for root cause analysis and potential legal action. Creating a forensic image of the file server and affected endpoints captures the ransomware artifacts, encryption keys, and system state before any recovery actions that could overwrite critical data. This aligns with the CISM incident management phase of 'lessons learned' and ensures the team can determine the attack vector and prevent recurrence.

Creating a forensic image with a write blocker (Option A) is a best practice because it captures an exact bit-for-bit copy of the storage media without altering the original data. The write blocker intercepts write commands at the hardware or software level, ensuring the integrity of the evidence. This preserves the original state for later analysis and admissibility in legal proceedings.

Option C is correct because 45 incidents (37.5%) have no documentation, indicating a process gap. Option A is not necessarily a gap; Option B is relatively low; Option D cannot be determined.

Option A is correct because immediate containment is the priority to stop further data loss. Other actions are important but should follow containment.

The SSH rule allows access from any source, which is a security risk. It should be restricted to internal IPs.