INCIDENT RESPONSE PROFESSIONAL
CERTIFICATION EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
Question 1
During a suspected ransomware incident, an incident responder
discovers that a Windows server is actively communicating with an
external IP address over TCP/443. The server is also hosting several
critical business applications. Which action should the responder take
FIRST?
A. Immediately power off the server to prevent further encryption
B. Disconnect the server from the network while preserving volatile
evidence when feasible
C. Delete the suspected ransomware executable
D. Restore the server from the most recent backup
Answer: B. Disconnect the server from the network while
preserving volatile evidence when feasible
Rationale: Network isolation limits command-and-control
communication and prevents lateral movement or additional
encryption while keeping the system available for evidence collection.
An immediate shutdown can destroy volatile evidence such as RAM
contents, active network connections, running processes, and
encryption keys. Deleting malware destroys evidence, while restoration
should occur only after containment, eradication, and appropriate
forensic preservation.
1
,Question 2
An analyst receives an alert indicating that a privileged administrator
account authenticated from an unfamiliar workstation at 03:15. The
authentication log shows a successful Kerberos logon followed by
access to several file servers. What should the analyst investigate
FIRST?
A. Whether the administrator was scheduled to work
B. Whether the workstation has sufficient disk space
C. Whether the authentication originated from a legitimate administrator
device and location
D. Whether the file servers have current antivirus signatures
Answer: C. Whether the authentication originated from a legitimate
administrator device and location
Rationale: A successful privileged authentication from an unexpected
endpoint is a high-priority indicator of possible credential
compromise. The responder should establish whether the source
workstation, account usage, time, and network location are legitimate
before expanding the investigation. This can reveal credential theft,
pass-the-hash, pass-the-ticket, remote access, or account takeover
activity.
Question 3
Which incident-response phase is primarily concerned with limiting an
attacker's ability to continue operating while preserving sufficient
evidence for investigation?
A. Preparation
B. Detection and analysis
2
,C. Containment
D. Lessons learned
Answer: C. Containment
Rationale: Containment focuses on preventing an incident from
spreading or causing additional damage. Short-term containment may
include isolating hosts, disabling compromised accounts, blocking
malicious infrastructure, or restricting network traffic. Effective
containment balances business continuity against the need to preserve
evidence and prevent attacker persistence.
Question 4
A workstation suspected of credential theft is still powered on. The
incident responder wants to determine whether malicious processes,
injected code, active network connections, or credentials exist in
memory. Which evidence should be collected?
A. Disk image only
B. RAM/memory capture
C. Printer spooler logs only
D. BIOS configuration only
Answer: B. RAM/memory capture
Rationale: Volatile memory can contain running processes, network
connections, command-line arguments, injected code, encryption keys,
authentication material, and other artifacts that may disappear when
the system is powered down. A forensic disk image is still valuable, but
it cannot replace memory acquisition when volatile evidence is
relevant.
Question 5
3
, A SOC analyst identifies a PowerShell process containing an encoded
command launched by Microsoft Office shortly after a user opened an
email attachment. Which combination provides the strongest initial
indication of a potential malicious execution chain?
A. PowerShell + Office parent process + encoded command
B. PowerShell + Windows Defender
C. Office + normal document opening
D. PowerShell + local administrator membership only
Answer: A. PowerShell + Office parent process + encoded command
Rationale: The parent-child process relationship is highly significant.
Office applications spawning PowerShell, particularly with encoded or
obfuscated commands, can indicate malicious document execution.
The responder should investigate the complete process tree, command
line, document source, user activity, network connections, and
subsequent child processes.
Question 6
An organization suspects that an attacker has obtained a domain
administrator credential. Which containment action is generally MOST
appropriate?
A. Delete the entire Active Directory database
B. Disable or reset the compromised privileged account and investigate
related credentials
C. Shut down every workstation immediately
D. Remove all domain controllers from the network
Answer: B. Disable or reset the compromised privileged account
and investigate related credentials
Rationale: A suspected privileged credential compromise requires
rapid identity containment. The account should be disabled or
4
CERTIFICATION EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
Question 1
During a suspected ransomware incident, an incident responder
discovers that a Windows server is actively communicating with an
external IP address over TCP/443. The server is also hosting several
critical business applications. Which action should the responder take
FIRST?
A. Immediately power off the server to prevent further encryption
B. Disconnect the server from the network while preserving volatile
evidence when feasible
C. Delete the suspected ransomware executable
D. Restore the server from the most recent backup
Answer: B. Disconnect the server from the network while
preserving volatile evidence when feasible
Rationale: Network isolation limits command-and-control
communication and prevents lateral movement or additional
encryption while keeping the system available for evidence collection.
An immediate shutdown can destroy volatile evidence such as RAM
contents, active network connections, running processes, and
encryption keys. Deleting malware destroys evidence, while restoration
should occur only after containment, eradication, and appropriate
forensic preservation.
1
,Question 2
An analyst receives an alert indicating that a privileged administrator
account authenticated from an unfamiliar workstation at 03:15. The
authentication log shows a successful Kerberos logon followed by
access to several file servers. What should the analyst investigate
FIRST?
A. Whether the administrator was scheduled to work
B. Whether the workstation has sufficient disk space
C. Whether the authentication originated from a legitimate administrator
device and location
D. Whether the file servers have current antivirus signatures
Answer: C. Whether the authentication originated from a legitimate
administrator device and location
Rationale: A successful privileged authentication from an unexpected
endpoint is a high-priority indicator of possible credential
compromise. The responder should establish whether the source
workstation, account usage, time, and network location are legitimate
before expanding the investigation. This can reveal credential theft,
pass-the-hash, pass-the-ticket, remote access, or account takeover
activity.
Question 3
Which incident-response phase is primarily concerned with limiting an
attacker's ability to continue operating while preserving sufficient
evidence for investigation?
A. Preparation
B. Detection and analysis
2
,C. Containment
D. Lessons learned
Answer: C. Containment
Rationale: Containment focuses on preventing an incident from
spreading or causing additional damage. Short-term containment may
include isolating hosts, disabling compromised accounts, blocking
malicious infrastructure, or restricting network traffic. Effective
containment balances business continuity against the need to preserve
evidence and prevent attacker persistence.
Question 4
A workstation suspected of credential theft is still powered on. The
incident responder wants to determine whether malicious processes,
injected code, active network connections, or credentials exist in
memory. Which evidence should be collected?
A. Disk image only
B. RAM/memory capture
C. Printer spooler logs only
D. BIOS configuration only
Answer: B. RAM/memory capture
Rationale: Volatile memory can contain running processes, network
connections, command-line arguments, injected code, encryption keys,
authentication material, and other artifacts that may disappear when
the system is powered down. A forensic disk image is still valuable, but
it cannot replace memory acquisition when volatile evidence is
relevant.
Question 5
3
, A SOC analyst identifies a PowerShell process containing an encoded
command launched by Microsoft Office shortly after a user opened an
email attachment. Which combination provides the strongest initial
indication of a potential malicious execution chain?
A. PowerShell + Office parent process + encoded command
B. PowerShell + Windows Defender
C. Office + normal document opening
D. PowerShell + local administrator membership only
Answer: A. PowerShell + Office parent process + encoded command
Rationale: The parent-child process relationship is highly significant.
Office applications spawning PowerShell, particularly with encoded or
obfuscated commands, can indicate malicious document execution.
The responder should investigate the complete process tree, command
line, document source, user activity, network connections, and
subsequent child processes.
Question 6
An organization suspects that an attacker has obtained a domain
administrator credential. Which containment action is generally MOST
appropriate?
A. Delete the entire Active Directory database
B. Disable or reset the compromised privileged account and investigate
related credentials
C. Shut down every workstation immediately
D. Remove all domain controllers from the network
Answer: B. Disable or reset the compromised privileged account
and investigate related credentials
Rationale: A suspected privileged credential compromise requires
rapid identity containment. The account should be disabled or
4
