Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company's incident response policy is being revised. The legal department requires that the policy specify which regulations apply to data breaches and who is responsible for notifying regulators. The security team wants the policy to define the boundaries of the incident response program. The current policy is vague and does not address these needs. What is the most effective way to update the policy?

   • AAdd sections on scope, roles, and compliance requirements to the policy
   • BInclude detailed technical procedures for incident response in the policy
   • CAdd a list of all applicable regulations without defining roles
   • DRemove the policy and rely on the incident response plan
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of an incident response policy?

   • ATo provide step-by-step technical instructions for handling a specific type of incident
   • BTo list the names and contact information of all employees in the organization
   • CTo establish the organization's high-level approach, scope, and authority for responding to security incidents
   • DTo document the technical details of a single incident after it has been resolved
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A hospital's incident response plan states that during a malware incident, the IT team should 'isolate affected systems.' However, the team is unsure whether to disconnect the network cable, disable the switch port, or block the system in the firewall. What is the most effective way to resolve this ambiguity?

   • AAsk the firewall vendor for a best-practice document
   • BDevelop a detailed procedure that specifies the exact steps for each isolation method
   • CTrain the team on general network security concepts
   • DUpdate the incident response plan to include a list of all possible isolation methods
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which element is typically included in an incident response policy?

   • AThe IP addresses of all known threat actors
   • BThe exact commands to run when isolating a compromised host
   • CThe forensic analysis results from the last major incident
   • DThe organization's definition of what constitutes a security incident
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst receives an alert from the SIEM about multiple failed login attempts followed by a successful login from an unusual geographic location. The analyst verifies that the user is currently on vacation and has not logged in. According to the NIST SP 800-61 incident response lifecycle, which stage is the analyst currently in?

   • APreparation
   • BContainment, Eradication, and Recovery
   • CDetection and Analysis
   • DPost-Incident Activity
   Reveal Solution Discussion Select an answer first