Introduction to Incident Handling and Response ECIH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is the correct sequence of the six phases in the incident handling process?

   • APreparation, Containment, Identification, Eradication, Recovery, Lessons Learned
   • BPreparation, Identification, Eradication, Containment, Recovery, Lessons Learned
   • CIdentification, Preparation, Containment, Eradication, Recovery, Lessons Learned
   • DPreparation, Identification, Containment, Eradication, Recovery, Lessons Learned
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a key ethical consideration when handling an incident that involves personal data?

   • AMinimizing access to personal data to only those who need it for the response
   • BDeleting all personal data immediately to protect privacy
   • CIgnoring privacy regulations to speed up the response
   • DSharing the data with all team members for transparency
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is updating its incident handling documentation. The security team wants to ensure that during a malware outbreak, the response team follows a consistent, step-by-step approach that includes specific technical actions and decision points. Which document should the team create or update?

   • AA data retention schedule that defines how long logs are kept.
   • BA high-level incident response policy that states the organization's commitment to security.
   • CA risk assessment report that identifies potential threats to the organization.
   • DAn incident response playbook that details the exact steps for malware containment and eradication.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   An incident is classified as 'high severity' because it affects a critical business system and is spreading rapidly. What should the incident response team do first?

   • AIgnore the incident if it is not affecting customers
   • BFocus on documenting the incident before taking action
   • CPrioritize this incident over lower-severity incidents
   • DWait for the next business day to begin the response
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A hospital's IT team detects a phishing email that has been opened by several employees, but no malware has been detected yet. At the same time, a ransomware alert is confirmed on a server that stores patient records. The incident manager must prioritize responses. Which incident should be handled first?

   • ABoth simultaneously with equal resources, because both are security incidents.
   • BThe ransomware alert, because it affects a critical system with high impact and urgency.
   • CThe phishing email first, because it is easier to contain than ransomware.
   • DThe phishing email, because it may affect multiple employees and could spread.
   Reveal Solution Discussion Select an answer first