Incident Handling Process SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has just finished recovering from a phishing campaign that compromised several mailboxes. The incident response team is about to hold a post-incident review. What is the PRIMARY goal of this review?

   • AEvaluate the effectiveness of the response and identify improvements to prevent future incidents.
   • BDetermine the total financial cost of the incident for insurance claims.
   • CIdentify which employees opened the phishing email and assign blame.
   • DDocument the timeline of the incident and archive all evidence for legal purposes.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which activity is part of the Lessons Learned phase?

   • AConducting a post-incident review meeting with the incident response team
   • BIsolating the affected systems from the network
   • CRestoring data from backups
   • DDeleting malware from the affected systems
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A small company is establishing its incident response capability. They have limited budget and want to ensure they can detect and respond to common incidents such as malware infections and phishing. Which activity is MOST important to perform during the Preparation phase?

   • AConduct a penetration test to identify vulnerabilities.
   • BDevelop an incident response policy and form a CSIRT with defined roles.
   • CInstall antivirus on all endpoints and servers.
   • DPurchase an expensive SIEM platform to collect all logs.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After containing a ransomware outbreak on several servers, the incident response team has isolated the affected systems and blocked the command-and-control domains. The team now needs to remove the threat from the environment. Which action best represents the Eradication phase?

   • ADocument the containment actions taken
   • BMonitor the servers for any signs of re-infection
   • CDelete the ransomware binaries and registry entries from each affected server
   • DRestore the servers from backups and verify data integrity
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary goal of the Recovery phase in incident handling?

   • ATo delete all malicious files from the system
   • BTo identify the root cause of the incident
   • CTo restore systems to normal operation and validate that they are functioning correctly
   • DTo isolate the affected systems from the network
   Reveal Solution Discussion Select an answer first