Introduction to Incident Handling and Response ECIH Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of incident handling and response in an organization?

   • ATo detect, respond to, and recover from security incidents in a structured manner
   • BTo eliminate all security risks before they occur
   • CTo ensure that all employees are trained on security awareness
   • DTo replace the need for antivirus and firewall solutions
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An incident handler in the EU discovers that a data breach involves personal data of EU residents. The company is based in the US. The handler has collected forensic evidence but is unsure about the legal obligations. What is the MOST appropriate action?

   • AConsult with legal counsel to determine applicable laws and notification requirements.
   • BNotify the EU data protection authority immediately without further analysis.
   • CIgnore the breach because it was discovered in the US.
   • DNotify the US authorities only, since the company is US-based.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company's incident response plan is outdated and does not cover cloud-based services. The company is migrating to a hybrid cloud environment. The CISO wants to update the plan to address cloud incidents. What is the MOST important consideration when updating the plan?

   • AIncluding specific procedures for cloud service providers and their incident response responsibilities.
   • BEnsuring the plan is the same for all incidents regardless of environment.
   • CRemoving all on-premises procedures to simplify the plan.
   • DFocusing only on the cloud provider's incident response plan.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A financial services firm experiences a suspected data breach. The incident response team has identified that an attacker exfiltrated a database containing customer financial records. The team is in the containment phase. The legal department wants to preserve evidence for potential litigation, while the business wants to restore the database quickly to minimize customer impact. What is the BEST course of action?

   • ADelete the database to prevent further data loss.
   • BKeep the database offline indefinitely until the investigation is complete.
   • CImmediately restore the database from backups to resume operations.
   • DPreserve forensic images of the affected systems and then restore the database from a known-clean backup.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a typical post-incident activity?

   • AConducting a lessons-learned meeting with the response team
   • BImmediately returning all systems to production without review
   • CDeleting all logs to free up storage space
   • DKeeping the incident details confidential from all stakeholders
   Reveal Solution Discussion Select an answer first