CISA Practice Test 14

File server incident at a regional hospital

At 2:00 a.m., the security operations center at a regional hospital detected large outbound transfers from a file server that stores patient records to an unknown external address. The on-call system administrator was paged, rebooted the server to stop the transfers and, the next morning, reimaged it from the standard build and restored the data from backup. The administrator then closed the incident ticket as resolved.

The server kept its event logs only on its local disk. No memory or disk image was taken. The incident response plan requires incidents involving systems that hold personal data to be escalated to the privacy officer, but contains no steps for preserving evidence. The privacy officer was never notified. A week later, legal counsel asked whether patient data had left the network, and no one could answer.