Incident Response CCT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst receives two alerts: one indicates a single workstation has adware installed, and the other indicates a domain controller is showing signs of credential theft. The team has limited resources. Which incident should be prioritized?

   • AThe domain controller incident, because it affects a critical system and may indicate a broader compromise
   • BThe adware incident, because it was detected first
   • CThe adware incident, because it is easier to remediate
   • DBoth incidents equally, because all incidents require the same level of attention
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A small business has no formal incident response plan. After a malware infection, the owner wants to ensure the business can respond effectively to future incidents. What is the MOST important first step?

   • APurchase advanced security software
   • BWait for the next incident to see what happens
   • CHire a third-party incident response firm
   • DDevelop an incident response plan and train employees on their roles
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a malware investigation, an analyst needs to collect a compromised laptop's memory for analysis. Which action is most appropriate to preserve the evidence's integrity?

   • ACopy the memory contents to a USB drive using standard Windows commands
   • BCreate a forensic image of the hard drive first, then collect memory
   • CPower off the laptop immediately to prevent further changes
   • DUse a trusted forensic tool to capture the memory contents while the system is running
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large organization is responding to a data breach. The incident commander is focused on coordinating the response, but the communications lead is also preparing a press release. The legal team has not yet approved the release. The communications lead wants to issue the release immediately to control the narrative. What should the incident commander do?

   • AAllow the communications lead to issue the release immediately.
   • BIssue the release themselves without legal review.
   • CInstruct the communications lead to wait for legal approval before issuing the release.
   • DTell the communications lead to focus on internal communications instead.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important to preserve evidence during incident response?

   • ATo support potential legal proceedings and ensure the accuracy of the investigation
   • BTo ensure the incident response team has something to do
   • CTo satisfy the requirements of cybersecurity insurance policies
   • DTo make the incident more difficult for attackers to repeat
   Reveal Solution Discussion Select an answer first