Incident Response CCT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   After a malware incident is contained and eradicated, the incident response team holds a post-incident review. What is the PRIMARY purpose of this review?

   • AVerify that all malware has been removed from the network.
   • BIdentify weaknesses in the response process and improve future incident handling.
   • CDetermine which employee caused the malware infection.
   • DCalculate the total cost of the incident for insurance claims.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A user reports receiving a phishing email that appears to come from the company's CEO, requesting urgent wire transfer. The user did not click any links. The email is still in the user's inbox. What is the FIRST step in the incident response procedure?

   • AReply to the email to ask if it is legitimate.
   • BPreserve the email as evidence and do not delete it.
   • CForward the email to all employees as a warning.
   • DDelete the email immediately to prevent further risk.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   Following a ransomware incident, the incident response team completes the recovery phase and restores all systems. What is the primary purpose of conducting a post-incident review?

   • ATo immediately implement all possible security controls to prevent any future incident
   • BTo identify what went well and what can be improved in the response process
   • CTo assign blame to the individuals who caused the incident
   • DTo delete all evidence related to the incident to avoid legal issues
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During a major security incident, the incident response team is activated. The incident commander is coordinating the response, the lead investigator is analyzing the attack vector, and the communications lead is handling external communications. A new piece of evidence is discovered that could affect the investigation. Who should be responsible for documenting this evidence?

   • AThe communications lead, to include it in public statements.
   • BThe lead investigator, as part of the investigation process.
   • CThe system administrator who found the evidence.
   • DThe incident commander, to maintain overall awareness.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary audience for an executive summary in an incident report?

   • AThe general public
   • BSenior management and business stakeholders who need a high-level overview
   • CTechnical staff who need detailed forensic data
   • DLaw enforcement officials who require legal evidence
   Reveal Solution Discussion Select an answer first