5.3 Apply the Incident Handling Process Such as NIST.SP800-61 to an Event 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During an active incident, the incident response team lead instructs a team member to document every action taken, including timestamps, who performed the action, and the outcome. Why is this documentation critical during the incident?

   • AIt satisfies the requirement to notify law enforcement within 24 hours
   • BIt ensures that the incident response team is paid for their overtime hours
   • CIt provides a legal record that can be used in court if the attacker is prosecuted
   • DIt allows the team to blame individual members if the incident is not resolved
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An analyst receives an alert from an intrusion detection system (IDS) about suspicious network traffic. What is the primary purpose of analyzing this alert in the context of incident handling?

   • ATo confirm whether the alert represents a real incident and characterize its scope
   • BTo immediately disconnect all affected systems without further investigation
   • CTo delete the alert from the log to reduce noise
   • DTo assign blame to the user who triggered the alert
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is the best example of a security incident rather than just a security event?

   • AA user receives a phishing email but does not click any links
   • BA system generates a routine audit log entry for a scheduled backup
   • CA firewall logs a blocked connection attempt from an external IP
   • DAn attacker successfully exfiltrates customer data from a database
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After a major incident, the incident response team conducts a post-incident review. The team finds that the incident was not detected for 48 hours because the monitoring tool was not configured to alert on the specific type of activity. Which recommendation should the team include in the lessons learned report?

   • ADisable the monitoring tool to reduce false positives
   • BAssign a single person to handle all future incidents
   • CImplement additional monitoring rules to detect similar activity in the future
   • DIncrease the frequency of full system backups
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is reviewing logs and finds that a user's account was used to access a sensitive file at 2:00 AM, which is outside the user's normal working hours. The analyst also sees that the user's account has been locked out multiple times in the past hour. The user is on vacation and has not been active. Which classification best describes this situation?

   • AA security incident, but only if the user confirms that they did not perform the activity
   • BA security event, because the activity is only a series of log entries and no damage has been confirmed
   • CA security incident, because the account activity indicates a likely compromise and unauthorized access to sensitive data
   • DA security event, because the account lockouts indicate that the access was blocked
   Reveal Solution Discussion Select an answer first