Describe the Elements of Cybersecurity Incident Response 100-160 Practice Questions (Page 9)

Questions 41–45

1. 41expert · medium

   A company is responding to a ransomware incident. The incident response team has identified the affected systems and wants to contain the spread. The team must decide between disconnecting the affected systems from the network and shutting them down. The forensic team needs to preserve evidence for a potential lawsuit. Which action should the team take?

   • ARebuild the systems from backups immediately
   • BDisconnect the affected systems from the network but keep them powered on
   • CShut down the affected systems immediately to stop the ransomware
   • DLeave the systems running and connected to the network to gather more evidence
   Reveal Solution Discussion Select an answer first
2. 42expert · medium

   A financial services firm is building its incident response capability. The firm has a limited budget and must choose between purchasing an expensive SIEM tool and conducting regular tabletop exercises. The firm's main concern is that its incident response team is new and lacks experience. Which choice best addresses the firm's concern?

   • APurchase the SIEM tool because it will automate detection and reduce the need for experienced staff
   • BPurchase the SIEM tool and skip training because the tool will handle everything
   • CConduct regular tabletop exercises to train the team and test the incident response plan
   • DConduct tabletop exercises but do not update the incident response plan
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which activity is part of the preparation stage of incident response?

   • AAnalyzing malware samples to determine their capabilities
   • BRestoring systems from backups
   • CConducting training and exercises for the incident response team
   • DIsolating affected systems from the network
   Reveal Solution Discussion Select an answer first
5. 44expert · medium

   A company's incident response plan includes a communication section that lists the incident response team, executives, and legal counsel. During a ransomware incident, the team discovers that the legal counsel's contact information is outdated, causing a delay in notifying the counsel. The team also realizes that the plan does not specify which systems are critical for business continuity. What is the most important improvement to make to the plan?

   • AUpdate the contact information for legal counsel
   • BAdd a section that identifies critical systems and their recovery priorities
   • CRemove the communication section because it caused the delay
   • DAdd more contact information for all employees
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A hospital is updating its incident response program. The compliance officer requires that all staff understand their specific duties during a security incident, and the IT team needs a documented procedure for isolating an infected workstation. Which combination of documents best satisfies these requirements?

   • AA network diagram and a list of approved software
   • BA single incident response plan that includes all possible technical commands
   • CA lessons-learned report from the last incident
   • DAn incident response policy that defines roles and a procedure that provides step-by-step isolation steps
   Reveal Solution Discussion Select an answer first