Introduction to Incident Handling and Response ECIH Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A company's incident response team is responding to a malware outbreak. The team includes a technical lead, a forensic analyst, and a communication lead. The communication lead is responsible for which task?

   • ACoordinating all internal and external communications about the incident.
   • BMaking the final decision on whether to shut down affected systems.
   • CAnalyzing the malware to determine its capabilities.
   • DCollecting forensic evidence from affected systems.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   After a security incident, the incident response team writes a detailed report. What is the PRIMARY purpose of this report?

   • ATo provide a basis for legal action against the attacker.
   • BTo document the incident and the response for future reference and improvement.
   • CTo assign blame to the responsible parties.
   • DTo satisfy the requirements of the insurance company.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   During a ransomware incident, the incident response team discovers that customer data has been encrypted. The CEO wants to pay the ransom to restore data quickly. The legal team advises against it. What is the BEST course of action?

   • APay the ransom because it is the fastest way to restore data.
   • BRefuse to pay the ransom and attempt to restore data from backups.
   • CPay the ransom but also inform law enforcement.
   • DIgnore the legal advice and pay the ransom.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is the primary factor used to prioritize incident response actions?

   • AThe number of systems affected
   • BThe impact on business operations and the urgency of the threat
   • CThe cost of the incident response tools
   • DThe type of malware involved
   Reveal Solution Discussion Select an answer first