Incident Management Life Cycle CS0-003 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary objective of disaster recovery?

   • ATo maintain business operations during a disruption without any downtime
   • BTo replace the need for business continuity planning
   • CTo prevent all disasters from occurring
   • DTo restore IT systems and data to a functional state after a disaster
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a suspected malware outbreak, an incident responder needs to capture the contents of memory from a compromised Windows workstation to analyze for indicators of compromise. The workstation is still running, and the responder wants to minimize changes to the system. Which tool should the responder use?

   • AMemDump
   • BVolatility
   • CDumpIt
   • DFTK Imager
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company has recently hired several new IT staff members who will be part of the incident response team. The team has an existing incident response plan and has conducted tabletop exercises in the past. What is the most important action to ensure the new members are prepared to respond effectively?

   • AGive them a copy of the incident response plan to read on their own
   • BHave them shadow a senior team member during the next incident
   • CWait until the next tabletop exercise to see how they perform
   • DProvide them with incident response training that includes their roles and responsibilities
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A regional bank has an incident response plan that was written three years ago and has never been tested. The CISO wants to validate the plan's effectiveness and identify gaps in roles and communication without disrupting live systems. Which action best meets this requirement?

   • AProvide incident response training to all employees and test their knowledge with a quiz
   • BReview the plan annually and update contact information without testing
   • CConduct a tabletop exercise with key stakeholders walking through a ransomware scenario
   • DRun a full-scale simulation that includes shutting down a non-critical server to test failover
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is the primary purpose of an incident response plan?

   • ATo provide a structured approach for detecting, responding to, and recovering from security incidents
   • BTo assign blame for security incidents and determine disciplinary actions
   • CTo document the technical configuration of all network devices for forensic purposes
   • DTo replace the need for security monitoring tools by defining manual detection procedures
   Reveal Solution Discussion Select an answer first