Incident Response Reporting CS0-003 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a malware outbreak, the incident response team holds a lessons learned meeting. Which outcome is the PRIMARY goal of this meeting?

   • ADetermine the financial impact of the incident.
   • BDocument the technical details of the malware.
   • CAssign blame to the individuals who made mistakes.
   • DIdentify improvements to the incident response process.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst detects a low-severity malware infection on a single workstation. The workstation is not connected to any sensitive systems, and the malware is contained. The organization's incident response plan defines an incident as 'any confirmed malicious activity that requires coordinated response.' The analyst is considering whether to declare an incident. Which action is MOST appropriate?

   • AEscalate to the CEO before declaring an incident.
   • BDeclare an incident because the malware is confirmed malicious activity.
   • CDo not declare an incident because the impact is low and the malware is contained.
   • DDeclare an incident only if the malware spreads to other systems.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of incident escalation in the incident response process?

   • ATo document the incident for compliance and regulatory reporting purposes.
   • BTo automatically contain and eradicate the threat without human intervention.
   • CTo ensure that incidents are brought to the attention of personnel with the appropriate authority and expertise to make decisions and take action.
   • DTo inform all employees of the incident so they can take personal protective measures.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of a key performance indicator (KPI) used to measure incident response effectiveness?

   • AThe number of employees in the security department.
   • BThe total amount of data stored in the organization.
   • CThe brand of the security tools used.
   • DMean time to respond (MTTR) to an incident.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During an active incident, the incident commander needs to provide a brief status update to the executive team. Which communication channel is MOST appropriate for this update?

   • AA scheduled conference call with the executive team.
   • BA secure instant messaging channel dedicated to the incident response team.
   • CA detailed email with all technical findings.
   • DA public social media post to inform customers.
   Reveal Solution Discussion Select an answer first