Incident Response Reporting CS0-003 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security operations center (SOC) analyst discovers a ransomware infection on a single file server that contains sensitive customer data. The analyst has isolated the server, but the malware is actively encrypting files. According to the incident response plan, which action should the analyst take FIRST?

   • AAttempt to stop the encryption by killing the malicious process.
   • BWait for the encryption to complete before escalating to preserve evidence.
   • CReboot the server to interrupt the encryption and then escalate.
   • DEscalate the incident to the incident commander and notify legal counsel.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which communication channel is most appropriate for real-time coordination among incident response team members during an active incident?

   • AA dedicated incident response chat channel or conference bridge.
   • BA voicemail message left on each team member's phone.
   • CA formal written report distributed via email.
   • DA public social media post to inform customers.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An incident responder is writing an incident report for a data breach. The report must include the scope of the incident, the root cause, and the actions taken. Which additional component is REQUIRED for a complete incident report?

   • AThe names of all employees who were involved.
   • BRecommendations for preventing future incidents.
   • CThe cost of the incident in terms of lost revenue.
   • DThe personal opinions of the incident responders.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a key consideration when communicating incident information to external stakeholders, such as customers or the public?

   • ADelay communication until the incident is fully resolved to avoid panic.
   • BShare all technical details, including exploited vulnerabilities, to be transparent.
   • CEnsure that communication is timely, accurate, and aligned with legal and regulatory requirements.
   • DCommunicate only through social media to reach the widest audience.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A web application was compromised due to a SQL injection vulnerability. The investigation shows that the vulnerability was introduced during a recent code update. What is the ROOT CAUSE of the incident?

   • AThe lack of a web application firewall (WAF).
   • BThe SQL injection vulnerability in the code.
   • CThe failure to perform code review before deployment.
   • DThe attacker who exploited the vulnerability.
   Reveal Solution Discussion Select an answer first