Incident Response CCT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary responsibility of the communications lead in an incident response team?

   • ATo perform forensic analysis of compromised systems
   • BTo determine the root cause of the incident
   • CTo coordinate all communications with stakeholders, including management, employees, and external parties
   • DTo contain the incident by isolating affected systems
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company detects a data breach that may have exposed customer data. The incident response team needs to preserve evidence for potential legal action. Which action is MOST appropriate?

   • AMake forensic copies of all relevant logs and systems involved
   • BNotify all customers before preserving evidence
   • CRestore the affected systems from backups immediately
   • DImmediately delete all logs related to the breach to prevent further exposure
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When prioritizing response actions for multiple concurrent incidents, which incident should be handled first?

   • AThe incident that involves the most systems
   • BThe incident that was detected first
   • CThe incident with the highest severity and impact on critical business functions
   • DThe incident that is easiest to resolve
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement best describes the scope of incident response?

   • AIt only involves technical actions such as patching and malware removal
   • BIt is primarily focused on legal prosecution of attackers
   • CIt encompasses the processes and procedures used to detect, analyze, contain, eradicate, and recover from security incidents
   • DIt is a one-time activity performed after a breach is discovered
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which type of incident documentation provides a chronological record of actions taken during the incident response?

   • AIncident log or timeline
   • BMarketing communication plan
   • CExecutive summary
   • DRisk assessment report
   Reveal Solution Discussion Select an answer first