Incident Response CCT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company discovers that an employee's credentials were used to access a sensitive database from a foreign IP address. The employee is currently on vacation and denies any involvement. The database contains customer personal data. The company must decide whether to notify affected customers and regulators. What is the MOST important factor in this decision?

   • AThe potential impact on the company's reputation.
   • BThe legal and regulatory requirements for data breach notification.
   • CThe employee's denial of involvement.
   • DThe cost of notifying customers.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a data breach, the incident response team must report to the CEO and to the IT security team. The CEO needs a high-level overview of business impact, while the security team needs technical details. How should the incident report be structured?

   • AOnly provide a verbal briefing to the CEO and a written report to the security team.
   • BSend the same detailed technical report to both parties.
   • CProvide a single report with an executive summary and a technical appendix.
   • DWait until the investigation is complete before reporting to anyone.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the first step in a standard operating procedure for responding to a suspected malware infection on a critical server?

   • AImmediately shut down the server to prevent further damage
   • BIsolate the affected system from the network while preserving evidence
   • CNotify law enforcement before taking any action
   • DReinstall the operating system to remove the malware
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which incident response phase involves implementing short-term fixes to stop the spread of an active threat?

   • AContainment
   • BEradication
   • CIdentification
   • DPreparation
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which action is a key component of the standard response procedure for a confirmed data breach involving customer personal data?

   • AIgnoring the breach if no financial loss has occurred
   • BNotifying affected customers and relevant regulatory authorities as required by law
   • CDeleting all affected data to prevent further exposure
   • DImmediately publishing the breach details on social media
   Reveal Solution Discussion Select an answer first