Incident Response SY0-701 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A global company has a distributed incident response team. A recent tabletop exercise revealed that team members in different regions have conflicting ideas about who has the authority to declare an incident and initiate containment. This caused delays during the exercise. The company wants to improve its training to address this issue. Which training approach is MOST effective?

   • AAppoint a single incident commander and communicate this decision via email to all team members.
   • BDevelop a detailed incident response policy that clearly defines roles, authority, and escalation paths, and incorporate it into mandatory training for all team members.
   • CConduct more frequent tabletop exercises to allow team members to practice and resolve conflicts organically.
   • DProvide each team member with a copy of the incident response plan and ask them to review it independently.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company's incident response plan has not been tested in two years. Management wants to test the plan's effectiveness but has limited budget and cannot afford a full-scale simulation. The company has a small IT team that is also responsible for daily operations. The primary goal is to identify gaps in the plan's procedures and communication. Which testing method is MOST appropriate given the constraints?

   • AConduct a tabletop exercise with the IT team and key stakeholders.
   • BPerform a full-scale simulation using a third-party red team.
   • CReview the incident response plan document and update it based on the review.
   • DRun an automated breach and attack simulation tool against the production environment.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is developing a new incident response training program. The training must ensure that all employees understand their specific roles during an incident, including who is authorized to make critical decisions. Which element is MOST important to include in the training?

   • AA comprehensive history of all past security incidents and their outcomes.
   • BA clear definition of the incident response team structure and escalation paths.
   • CA tutorial on using the company's endpoint detection and response (EDR) tool.
   • DA detailed list of all known malware signatures and their behaviors.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a key characteristic of threat hunting compared to traditional security monitoring?

   • AIt focuses only on known vulnerabilities
   • BIt is proactive rather than reactive
   • CIt relies solely on automated tools
   • DIt is performed only after an incident is confirmed
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's incident response plan has not been updated in two years. Management wants to test the plan's effectiveness without causing a real outage. The goal is to identify gaps in communication and decision-making processes among the incident response team. Which testing method is MOST appropriate?

   • ARun an automated vulnerability scan against the production environment.
   • BReview the incident response plan document for spelling and formatting errors.
   • CPerform a tabletop exercise with key stakeholders discussing a hypothetical scenario.
   • DConduct a full-scale simulation that includes shutting down a production server.
   Reveal Solution Discussion Select an answer first