Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In an incident response plan, what is the main purpose of the 'preparation' component?

   • ATo isolate affected systems from the network to prevent further damage
   • BTo identify the root cause of an incident after it has been contained
   • CTo ensure the organization is ready to handle incidents effectively before they occur
   • DTo collect and preserve evidence for potential legal action
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   After a phishing incident, the incident response team conducts a lessons-learned meeting. The team identifies that the phishing email bypassed the email filter because the filter was not configured to detect the specific attachment type. The team decides to update the email filter rules and revise the incident response plan to include a step for reviewing filter configurations. Which two post-incident activities are the team performing?

   • AEradication and recovery
   • BLessons learned and plan improvement
   • CPreparation and training
   • DDetection and analysis and containment
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company experienced a data breach that was traced to an unpatched vulnerability in a public-facing web server. After the incident is resolved, the security team wants to prevent a recurrence. Which post-incident activity is most directly aimed at this goal?

   • AChanging the web server's IP address
   • BDeleting the incident response logs
   • CConducting a lessons-learned review and updating the patch management process
   • DRestoring the web server from backup
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A regional bank has an incident response plan that lists the incident response team and their contact information, but the plan does not specify which systems are in scope or how to prioritize containment efforts. During a ransomware event, the team spends time debating whether to isolate the file server or the domain controller first. Which component is most clearly missing from the plan?

   • AA clear definition of the plan's scope and system prioritization criteria
   • BA communication plan for notifying executives and customers
   • CA detailed set of step-by-step procedures for each containment action
   • DA list of compliance requirements that the bank must follow
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A hospital is updating its incident response plan. The compliance officer requires that the plan clearly define who is responsible for notifying regulators in case of a data breach. The security team wants the plan to include a step-by-step procedure for isolating an infected workstation. The plan currently only lists high-level actions. What is the most appropriate way to satisfy both requirements?

   • AInclude the full isolation procedure in the plan and omit the regulatory notification details
   • BAdd a roles and responsibilities section to the plan and create a separate isolation procedure document
   • CCreate a policy that includes both the roles and the isolation procedure
   • DLeave the plan as is and rely on the security team's experience
   Reveal Solution Discussion Select an answer first