Introduction to Incident Handling and Response ECIH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During a ransomware investigation, an incident handler discovers that the attacker accessed a database containing personal data of EU citizens. The company is based in the US. The handler needs to preserve evidence and also comply with legal obligations. What should the handler do FIRST?

   • ANotify the relevant data protection authority immediately, before any further analysis.
   • BPreserve the database and related logs as evidence, and consult legal counsel about breach notification requirements.
   • CIgnore the data protection issue because the company is in the US.
   • DErase the database to prevent further exposure of personal data.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of an incident handling policy?

   • ATo establish the organization's high-level approach and requirements for incident handling
   • BTo list the names of all incident response team members
   • CTo provide step-by-step technical instructions for responding to specific incidents
   • DTo replace the need for incident response training
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During a data breach investigation, the incident response team discovers that the breach involves personal data of customers in multiple countries. The legal team requests a detailed technical report, while the public relations team needs a summary for a press release. What is the best communication strategy?

   • AProvide the legal team with a detailed technical report and the PR team with an approved summary that omits sensitive technical details.
   • BSend the same detailed technical report to both teams to ensure transparency.
   • CLet the PR team release the technical report directly to the public to be transparent.
   • DWithhold all information from both teams until the investigation is complete.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is incident handling and response important for organizational security?

   • AIt helps minimize the impact of incidents and ensures business continuity
   • BIt guarantees that no security incident will ever occur again
   • CIt replaces the need for a business continuity plan
   • DIt is only required for organizations that handle classified data
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company's incident response team is handling a data breach. The team has identified the attack vector and is ready to contain the incident. However, the legal team wants to preserve evidence for a potential lawsuit. The business wants to minimize downtime. What is the BEST way to balance these needs?

   • AIgnore the legal team and focus only on business continuity.
   • BContain the incident immediately and worry about evidence later.
   • CShut down all affected systems to stop the breach.
   • DPreserve evidence first, then contain the incident using methods that do not destroy evidence.
   Reveal Solution Discussion Select an answer first