Incident Management Life Cycle CS0-003 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary role of an incident response playbook?

   • ATo list all hardware and software assets in the organization
   • BTo document the organization's business continuity strategies
   • CTo provide step-by-step procedures for handling specific types of incidents
   • DTo replace the incident response plan with a more flexible document
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a key component typically found in an incident response plan?

   • AA list of all employee passwords for account recovery
   • BA list of incident response team members and their roles
   • CA detailed network topology diagram for all external partners
   • DA schedule for annual employee performance reviews
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic analyst is investigating a suspected insider threat. The analyst has a forensic image of the suspect's workstation and needs to determine if the suspect accessed a specific file on a network share. The analyst has the file's hash. Which approach is most effective?

   • AReview the firewall logs for connections to the network share
   • BSearch the forensic image for the file's hash
   • CAnalyze the Windows prefetch files and shortcut files in the image
   • DInterview the suspect to ask if they accessed the file
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company experienced a data breach that was traced to a misconfigured firewall rule that allowed unauthorized external access to a database. The incident response team has contained the breach and eradicated the threat. What is the next step the team should take to prevent a recurrence?

   • ARestore the database from backups
   • BConduct a root cause analysis to identify why the firewall rule was misconfigured
   • CNotify law enforcement
   • DUpdate the incident response plan
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A small company is developing its first incident response plan. The plan will be used by a team of three IT staff who have limited security experience. Which approach is most effective for creating a usable plan?

   • AFocus only on technical procedures and omit communication plans
   • BCreate a detailed plan that covers every possible incident type
   • CDevelop a concise plan with clear roles and basic procedures for common incidents
   • DUse a generic plan template from the internet without customization
   Reveal Solution Discussion Select an answer first