Incident Response SY0-701 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of regularly testing an incident response plan?

   • ATo guarantee that all incidents will be prevented
   • BTo satisfy regulatory requirements only
   • CTo identify weaknesses and improve the plan's effectiveness
   • DTo replace the need for security monitoring tools
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During a forensic investigation, an analyst must ensure that the original evidence is not altered. Which forensic principle is being applied?

   • AOrder of volatility
   • BLegal hold
   • CChain of custody
   • DPreservation of evidence
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security team proactively searches its network for signs of a known advanced persistent threat (APT) that has not yet triggered any alerts. What is this activity called?

   • AThreat hunting
   • BVulnerability management
   • CIncident response
   • DPenetration testing
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services firm is updating its incident response training. A recent phishing simulation revealed that employees frequently click links in emails before reporting them. The training program must address this behavior while also teaching employees how to recognize and report incidents. Which training approach BEST addresses the identified gap?

   • ADistribute an annual policy document detailing the incident response procedures.
   • BProvide a one-time lecture on the history of recent security breaches in the industry.
   • CImplement a hands-on phishing simulation with immediate feedback and reporting practice.
   • DConduct quarterly tabletop exercises focused on executive decision-making during a breach.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is reviewing network logs and notices a series of failed login attempts from a single IP address to multiple user accounts, followed by a successful login from the same IP to a service account that has not been used in six months. The analyst has no prior alerts for this activity. What is the MOST appropriate next step?

   • ADisable the service account and reset its password.
   • BInitiate a formal incident response process and declare a breach.
   • CImmediately block the IP address at the firewall.
   • DProactively hunt for additional indicators of compromise from the same IP and the service account.
   Reveal Solution Discussion Select an answer first