Incident Response Process CSA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A SOC team is overwhelmed with alerts. The team has a SIEM that generates alerts based on correlation rules. The team needs to reduce false positives while ensuring critical incidents are not missed. Which approach is BEST?

   • ADisable all alerts that have produced false positives in the past
   • BIncrease the severity of all alerts to ensure they are noticed
   • CTune the SIEM correlation rules based on historical false-positive rates and adjust thresholds
   • DAdd more correlation rules to catch more threats
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An organization uses a multi-cloud environment (AWS and Azure). A security incident is detected in an AWS S3 bucket, and the incident response team needs to preserve evidence. The team is concerned about the shared responsibility model and legal admissibility. What is the BEST approach?

   • AContact AWS support to request a physical copy of the S3 data
   • BDelete the bucket to prevent further access
   • CCopy the S3 bucket contents to an on-premises forensic server using AWS CLI
   • DEnable S3 versioning and bucket logging, then take a snapshot of the bucket using AWS Backup
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   After a major security incident, the SOC manager is writing the post-incident report. The report will be shared with senior management, legal counsel, and the technical team. Which approach best addresses the needs of all stakeholders?

   • AWrite a highly technical report with all forensic details for all stakeholders.
   • BWrite separate reports for each stakeholder with no overlap.
   • CWrite a single report with an executive summary, a technical timeline, and legal considerations clearly separated.
   • DWrite a brief summary with no technical details to protect sensitive information.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   During which phase of the incident response lifecycle does an organization define roles, establish communication channels, and deploy monitoring tools before an incident occurs?

   • APreparation
   • BContainment
   • CPost-Incident Activity
   • DDetection and Analysis
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company runs a critical application on a cloud VM. During an incident, the VM is compromised. The company needs to preserve evidence for legal action while also restoring service quickly. The cloud provider offers the ability to snapshot the VM. What is the best approach?

   • ARestore the VM from the latest snapshot and continue operations.
   • BTerminate the VM immediately and rely on the provider's automatic backups.
   • CTake a snapshot of the VM before terminating it, then restore service from a clean backup.
   • DKeep the VM running and perform live analysis without taking a snapshot.
   Reveal Solution Discussion Select an answer first