Incident Response Reporting CS0-003 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After a major incident, the incident response team is conducting a lessons learned review. Which activity is MOST likely to be part of this review?

   • APraising the team for their hard work without discussing improvements.
   • BReviewing the incident timeline to identify what went well and what did not.
   • CDeleting all incident-related logs to free up storage.
   • DImmediately implementing new security tools without discussion.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   During a major incident, the incident commander needs to communicate with external stakeholders, including customers and regulatory bodies. Which communication strategy is MOST appropriate?

   • ASend detailed technical reports to customers.
   • BPost updates on social media without prior approval.
   • CAllow the incident commander to communicate directly with customers.
   • DCoordinate all external communications through the public relations (PR) and legal teams.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security incident occurred because a patch was not applied to a critical server. The investigation reveals that the patch management process failed because the server was not included in the automated patching schedule. What is the ROOT CAUSE of the incident?

   • AThe lack of a security awareness program.
   • BThe attacker who exploited the vulnerability.
   • CThe vulnerability in the server's software.
   • DThe server was not included in the automated patching schedule.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which technique is commonly used to conduct a root cause analysis by repeatedly asking 'why' to drill down to the underlying cause?

   • AThe SWOT analysis.
   • BThe Gantt chart.
   • CThe '5 Whys' technique.
   • DThe Pareto chart.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an incident, the incident response team needs to share sensitive technical information with a third-party vendor that is assisting with the response. What is the MOST secure method of communication?

   • AA post on the company's public social media page.
   • BA regular phone call with the vendor.
   • CA public cloud file-sharing service without encryption.
   • DEncrypted email with the vendor's security team.
   Reveal Solution Discussion Select an answer first