Incident Response CCT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   After an incident, the incident response team is writing the final report. The report will be shared with the board of directors, who are not technical. The report must also be detailed enough for the internal security team to use for future improvements. What is the BEST way to structure the report?

   • AOnly provide a verbal summary to the board and a written report to the security team.
   • BWrite a single technical report for both audiences.
   • CInclude an executive summary for the board and a technical appendix for the security team.
   • DDelay the report until all technical details are finalized.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the main purpose of a post-incident review?

   • ATo determine the exact financial cost of the incident
   • BTo assign blame to individuals who made mistakes
   • CTo identify what happened, what was done well, and what can be improved
   • DTo delete all evidence related to the incident
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company experiences a ransomware attack that encrypts critical files. The incident response team is considering whether to pay the ransom. Which action is MOST aligned with standard incident response procedures?

   • ANotify the media before taking any action
   • BPay the ransom immediately to restore operations quickly
   • CRestore the encrypted files from backups and investigate the attack vector
   • DIgnore the incident and continue normal operations
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an incident, a first responder collects a USB drive from a suspect's desk. The responder labels it with their initials, date, and time, then places it in a locked evidence locker. Later, the lead investigator retrieves the drive for analysis. What additional step is REQUIRED to maintain the chain of custody?

   • ATake a photo of the drive in place.
   • BStore the drive in a fireproof safe.
   • CDocument every transfer of the drive, including who handled it and when.
   • DCreate a forensic image of the drive before any analysis.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of a chain of custody in evidence handling during incident response?

   • ATo ensure that evidence is stored in a secure location
   • BTo prioritize which evidence is most important for the investigation
   • CTo document the chronological history of evidence handling to prove its integrity and admissibility
   • DTo encrypt all evidence to prevent unauthorized access
   Reveal Solution Discussion Select an answer first