Introduction to Incident Handling and Response ECIH Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Why is it important to follow proper evidence handling procedures during incident response?

   • ATo ensure that evidence is admissible in legal proceedings
   • BTo reduce the cost of the incident response
   • CTo speed up the incident response process
   • DTo ensure that all employees are aware of the incident
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company's incident response plan is being revised. The previous plan was too generic and did not provide specific guidance for different types of incidents. The security team wants to ensure that during a ransomware attack, the response team knows exactly which systems to isolate, who to contact, and what evidence to collect. What is the best approach to improve the plan?

   • AReplace the plan with a single detailed procedure for ransomware only.
   • BOnly update the contact list and leave the rest of the plan unchanged.
   • CKeep the plan generic so that responders can use their judgment in each situation.
   • DCreate detailed playbooks for each incident type, including ransomware, with specific technical steps and contact lists.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A financial services company has a security operations center that detects two incidents simultaneously. Incident A is a phishing campaign targeting employees, with several users having clicked the link, but no confirmed compromise. Incident B is a potential data exfiltration from a non-critical development server, with logs showing large outbound transfers. The company has limited incident response resources. The incident manager must decide how to allocate resources. What is the most appropriate prioritization?

   • APrioritize Incident A because phishing can lead to credential compromise and affect many users.
   • BPrioritize Incident B because data exfiltration indicates a confirmed breach with high impact, while Incident A is still under investigation.
   • CTreat both incidents equally and split resources 50/50.
   • DIgnore Incident B because it is only a development server and not critical.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   During a suspected data breach involving customer payment card data, the incident response team is activated. The incident manager needs to assign a single point of contact for external legal counsel and regulatory authorities. Which role should be assigned this responsibility?

   • AThe lead forensic analyst, who can provide technical details to legal counsel.
   • BThe IT help desk manager, who is familiar with the affected systems.
   • CThe communication lead, who coordinates all external communications and legal notifications.
   • DThe chief financial officer, who can assess the financial impact of the breach.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company's incident response team is responding to a malware infection. The team needs to coordinate with the IT department to isolate affected systems, with legal counsel to assess notification obligations, and with public relations to prepare a statement. Which role is responsible for coordinating these efforts?

   • AThe IT help desk lead, who manages user support tickets.
   • BThe forensic analyst, who handles the technical investigation.
   • CThe legal counsel, who advises on legal obligations.
   • DThe incident manager, who oversees the entire response and coordinates all teams and stakeholders.
   Reveal Solution Discussion Select an answer first