Incident Management Life Cycle CS0-003 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's incident response team has been trained on the incident response plan, but the team has never participated in a simulation. Management wants to ensure the team can apply their training in a realistic scenario. Which action is most effective?

   • AConduct a tabletop exercise that presents a realistic incident scenario
   • BProvide additional classroom training on incident response
   • CReview the incident response plan in a meeting
   • DWait for a real incident to test the team's skills
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the first step in the forensic analysis process during an incident?

   • APreserving the integrity of evidence
   • BNotifying law enforcement
   • CAnalyzing the malware code
   • DRebuilding the affected systems
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary goal of business continuity planning?

   • ATo prevent all security incidents from occurring
   • BTo ensure that critical business functions can continue during and after a disruption
   • CTo restore IT systems to their original state after a disaster
   • DTo transfer all business risks to insurance providers
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare organization wants to improve its incident response readiness by testing the decision-making and communication of its incident response team during a simulated data breach. The organization cannot afford to disrupt production systems. Which exercise is most appropriate?

   • AA full-scale simulation involving actual system shutdowns
   • BA training session on incident response procedures
   • CA technical drill that executes the incident response plan on a test network
   • DA tabletop exercise with a scenario walkthrough and discussion
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security operations center (SOC) is developing a playbook for handling ransomware incidents. The playbook should include steps for isolating infected systems, identifying the ransomware variant, and restoring from backups. Which additional element is critical to include in the playbook?

   • AA script for automatically decrypting all files
   • BA detailed guide on how to negotiate with the attackers
   • CA decision tree for when to pay the ransom
   • DA list of contacts for law enforcement and legal counsel
   Reveal Solution Discussion Select an answer first