Incident Response SY0-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is investigating a suspected insider threat. The security team needs to collect evidence from an employee's laptop, but the employee is a senior executive and the laptop contains sensitive business data. The team must preserve evidence for potential legal action. Which action is the MOST appropriate?

   • ASeize the laptop and create a forensic image using a write blocker.
   • BCopy the employee's files to a network share for analysis.
   • CRemotely wipe the laptop to protect the sensitive business data.
   • DAsk the employee to voluntarily provide the laptop for analysis.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   After a security incident, an analyst investigates why a misconfigured firewall rule allowed unauthorized access. What is the primary goal of this root cause analysis?

   • ATo restore systems to normal operation
   • BTo collect evidence for legal proceedings
   • CTo assign blame to the responsible employee
   • DTo identify the underlying reason the incident occurred
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common method used to deliver incident response training to staff?

   • AConducting a forensic analysis
   • BTabletop exercises
   • CInstalling antivirus software
   • DPerforming a risk assessment
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of creating a forensic image of a storage device during an investigation?

   • ATo encrypt the device's contents
   • BTo delete incriminating files from the device
   • CTo preserve the original evidence while allowing analysis on a copy
   • DTo speed up the device's performance
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization's incident response plan has been updated. To ensure the plan is effective, the security manager wants to test the technical capabilities of the team, including their ability to detect and respond to a simulated attack on a non-production system. Which testing method is MOST appropriate?

   • APerform a full-scale simulation, such as a red team exercise, on a test environment.
   • BRun a vulnerability scan against the production network.
   • CConduct a tabletop exercise with the incident response team.
   • DReview the incident response plan document for completeness.
   Reveal Solution Discussion Select an answer first