Incident Response Technician Level II
Exam Practice Questions And Correct
Answers (Verified Answers) Plus
Rationales 2026 Q&A | Instant
Download Pdf
1. Which of the following is the primary goal of incident response?
A. Increase network traffic
B. Maintain system uptime
C. Minimize damage and restore normal operations
D. Deploy new software
Rationale: The primary goal of incident response is to contain and mitigate
incidents, minimize damage, and restore systems to normal operations.
2. What is the first step in the incident response lifecycle?
A. Recovery
B. Eradication
, C. Preparation
D. Containment
Rationale: Preparation ensures that the organization has policies, tools, and
procedures ready to respond to incidents.
3. Which type of incident involves unauthorized access to sensitive
information?
A. Malware infection
B. Data breach
C. Denial of service
D. Phishing
Rationale: A data breach occurs when sensitive information is accessed
without authorization.
4. Which log source is most useful for detecting lateral movement in a
network?
A. Application logs
B. Network traffic logs
C. Printer logs
D. Email logs
Rationale: Network traffic logs can show unusual patterns that indicate
lateral movement between systems.
5. What is the purpose of a forensic image?
A. To clean a system
, B. To capture an exact copy of data for investigation
C. To restore backups
D. To scan for malware
Rationale: Forensic imaging captures a bit-by-bit copy of data, preserving
evidence for analysis.
6. Which malware type encrypts files and demands payment for
decryption?
A. Spyware
B. Adware
C. Ransomware
D. Rootkit
Rationale: Ransomware encrypts files and requests a ransom to restore
access.
7. During incident response, which step involves eliminating malicious
artifacts?
A. Identification
B. Eradication
C. Containment
D. Recovery
Rationale: Eradication removes malware, malicious accounts, and other
artifacts from the environment.
, 8. Which of the following is an indicator of compromise (IoC)?
A. Daily backup success
B. Unusual outbound traffic
C. Scheduled task completion
D. Normal CPU usage
Rationale: Indicators of compromise are signs that a system has been
breached, such as unusual network activity.
9. Which type of attack floods a system to make it unavailable?
A. Phishing
B. Man-in-the-middle
C. Denial-of-service (DoS)
D. SQL injection
Rationale: DoS attacks overwhelm systems to disrupt availability.
10. Which document defines roles, responsibilities, and procedures
during an incident?
A. Privacy policy
B. Acceptable use policy
C. Incident response plan
D. Disaster recovery plan
Rationale: The incident response plan guides personnel on handling and
reporting incidents.
Exam Practice Questions And Correct
Answers (Verified Answers) Plus
Rationales 2026 Q&A | Instant
Download Pdf
1. Which of the following is the primary goal of incident response?
A. Increase network traffic
B. Maintain system uptime
C. Minimize damage and restore normal operations
D. Deploy new software
Rationale: The primary goal of incident response is to contain and mitigate
incidents, minimize damage, and restore systems to normal operations.
2. What is the first step in the incident response lifecycle?
A. Recovery
B. Eradication
, C. Preparation
D. Containment
Rationale: Preparation ensures that the organization has policies, tools, and
procedures ready to respond to incidents.
3. Which type of incident involves unauthorized access to sensitive
information?
A. Malware infection
B. Data breach
C. Denial of service
D. Phishing
Rationale: A data breach occurs when sensitive information is accessed
without authorization.
4. Which log source is most useful for detecting lateral movement in a
network?
A. Application logs
B. Network traffic logs
C. Printer logs
D. Email logs
Rationale: Network traffic logs can show unusual patterns that indicate
lateral movement between systems.
5. What is the purpose of a forensic image?
A. To clean a system
, B. To capture an exact copy of data for investigation
C. To restore backups
D. To scan for malware
Rationale: Forensic imaging captures a bit-by-bit copy of data, preserving
evidence for analysis.
6. Which malware type encrypts files and demands payment for
decryption?
A. Spyware
B. Adware
C. Ransomware
D. Rootkit
Rationale: Ransomware encrypts files and requests a ransom to restore
access.
7. During incident response, which step involves eliminating malicious
artifacts?
A. Identification
B. Eradication
C. Containment
D. Recovery
Rationale: Eradication removes malware, malicious accounts, and other
artifacts from the environment.
, 8. Which of the following is an indicator of compromise (IoC)?
A. Daily backup success
B. Unusual outbound traffic
C. Scheduled task completion
D. Normal CPU usage
Rationale: Indicators of compromise are signs that a system has been
breached, such as unusual network activity.
9. Which type of attack floods a system to make it unavailable?
A. Phishing
B. Man-in-the-middle
C. Denial-of-service (DoS)
D. SQL injection
Rationale: DoS attacks overwhelm systems to disrupt availability.
10. Which document defines roles, responsibilities, and procedures
during an incident?
A. Privacy policy
B. Acceptable use policy
C. Incident response plan
D. Disaster recovery plan
Rationale: The incident response plan guides personnel on handling and
reporting incidents.
