Introduction to Incident Handling and Response ECIH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized company is creating its first incident response plan. The CISO wants the plan to clearly define who makes the decision to shut down a compromised server, what steps to take to preserve evidence, and how to notify legal and PR. Which document should the team create to meet these requirements?

   • AA detailed incident response playbook that includes decision trees, evidence preservation steps, and notification templates.
   • BA business continuity plan that focuses on restoring critical services after an outage.
   • CA high-level incident response policy that states the organization's commitment to security and defines roles.
   • DA data retention policy that specifies how long logs and forensic images must be kept.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   After a significant security incident, the incident response team is preparing the final report. The report will be shared with senior management, legal counsel, and technical staff. Each audience has different information needs. What is the best way to structure the report?

   • AOnly provide a verbal summary to management and a written report to legal.
   • BWrite a single detailed technical report and send it to all stakeholders.
   • CDelay the report until all legal proceedings are complete.
   • DCreate an executive summary for management, a legal section for counsel, and a technical appendix for the technical team.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational company experiences a data breach involving personal data of customers in the EU and the US. The incident response team must decide how to handle the evidence and notifications. The company has legal counsel in both regions. Which approach best balances legal and operational requirements?

   • ADestroy all evidence to protect customer privacy and avoid legal exposure.
   • BOnly notify EU customers because EU regulations are stricter than US regulations.
   • CPreserve evidence according to forensic standards, and coordinate with legal counsel in each region to determine notification obligations.
   • DImmediately notify all affected customers in both regions without consulting legal counsel.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a ransomware incident, the incident response team needs to communicate with employees, customers, and law enforcement. What is the BEST approach to manage these communications?

   • ADesignate a single communication lead to coordinate all external and internal messaging.
   • BCommunicate only with law enforcement and ignore employees and customers.
   • CAvoid all communication until the incident is fully resolved.
   • DLet each team member communicate directly with whoever asks for information.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During which phase of incident handling does the team focus on removing the root cause of the incident from affected systems?

   • ARecovery
   • BLessons Learned
   • CContainment
   • DEradication
   Reveal Solution Discussion Select an answer first