Incident Response CCT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An incident response team is documenting a security incident. The team needs to create a report that will be shared with law enforcement. What information is MOST important to include?

   • AThe names of all employees involved in the response.
   • BDetailed technical findings and evidence handling procedures.
   • CA summary of the incident for public relations.
   • DThe estimated cost of the incident.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a limited incident response team. Two incidents occur: a low-severity malware infection on a single workstation and a suspected data exfiltration from a critical server. The team can only handle one incident at a time. What is the BEST approach?

   • AHandle the malware infection first because it is easier.
   • BIgnore the malware infection and focus only on the data exfiltration.
   • CSplit the team to handle both incidents simultaneously.
   • DPrioritize the data exfiltration incident and contain the malware infection with temporary measures.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's intrusion detection system alerts on a possible unauthorized access to a database containing customer records. The alert is confirmed as a true positive. What is the NEXT step in the incident response procedure?

   • ARecover the database from backups.
   • BConduct a lessons-learned review.
   • CEradicate the threat by removing the attacker's access.
   • DContain the incident to prevent further unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   During an incident, a first responder accidentally turns off a compromised server before a forensic image is taken. The server is later rebooted and used for normal operations. The incident response team is now preparing a report for potential litigation. What is the BEST way to handle this situation?

   • AHide the mistake to avoid compromising the case.
   • BDocument the mistake and its impact on evidence integrity in the report.
   • CRecreate the evidence by simulating the incident.
   • DBlame the first responder for the mistake.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team receives two incident alerts: one is a low-severity phishing email that was not clicked, and the other is a high-severity malware infection on a critical server. Which incident should be handled first?

   • AThe malware infection, because it affects a critical server and has a higher severity
   • BThe phishing email, because it was reported first
   • CBoth incidents simultaneously, because all incidents are equally important
   • DThe phishing email, because it is easier to remediate
   Reveal Solution Discussion Select an answer first