1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   After a significant data breach, the incident response team completes the post-incident review. The review reveals that the organization lacked a formal incident response plan and that communication with legal counsel was delayed. Which improvement should the organization prioritize?

   • APurchase additional security monitoring tools.
   • BIncrease the security team's budget for training.
   • CAssign blame to the team members who delayed legal communication.
   • DDevelop and implement a formal incident response plan that includes legal communication procedures.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to establish communication protocols before an incident occurs?

   • ATo ensure that only the incident response team is informed
   • BTo prevent all communication with external parties
   • CTo eliminate the need for incident documentation
   • DTo ensure that the right information reaches the right people in a timely manner
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the main purpose of a post-incident review?

   • ATo restore systems to their normal operational state
   • BTo identify lessons learned and improve the incident response process
   • CTo contain the incident and prevent further damage
   • DTo eradicate the root cause from affected systems
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After resolving a malware outbreak, the incident response team holds a lessons-learned meeting. Which outcome is most important for improving future incident response?

   • ADocumenting specific improvements to the incident response plan and implementing them.
   • BCreating a detailed timeline of the incident for public release.
   • CIdentifying which team members were responsible for the delays.
   • DDeleting all incident-related logs to reduce storage costs.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which practice is essential for preserving the integrity of digital evidence?

   • AStoring the evidence on the original system
   • BUsing the evidence for daily operational purposes
   • CAllowing multiple analysts to handle the evidence without documentation
   • DCreating a cryptographic hash of the evidence at the time of collection
   Reveal Solution Discussion Select an answer first