Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A small company is building its incident response capability. It has limited budget and no dedicated security staff. The management wants to be ready for common incidents like phishing and ransomware. Which preparation activity should the company prioritize?

   • APurchase an expensive enterprise SIEM platform and hire a 24/7 SOC team.
   • BFocus only on purchasing cyber insurance and ignore technical controls.
   • CDevelop a simple incident response plan, assign roles to existing IT staff, and deploy basic endpoint protection and email filtering.
   • DWait until an incident occurs to learn what is needed.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After a data breach, the incident response team completes the lessons learned phase. The team identifies that the incident response plan lacked clear escalation procedures, which caused delays. Which action should the team take to improve future response?

   • AUpdate the incident response plan to include clear escalation procedures.
   • BDelete the incident response plan and start over.
   • CConduct another penetration test to find more vulnerabilities.
   • DReplace the incident response team with new members.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which activity is a key component of the Preparation phase in the incident response lifecycle?

   • ARestoring systems from verified backups
   • BAnalyzing forensic evidence to determine the attack vector
   • CDeploying endpoint detection and response (EDR) tools
   • DIsolating infected systems from the network
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After a significant security incident, the incident response team completes the recovery phase and systems are back to normal. The team leader wants to ensure that the organization learns from the incident and improves its response capabilities. Which action is most aligned with the lessons learned phase?

   • ASchedule a post-incident review meeting to discuss what went well and what could be improved.
   • BImmediately move on to the next project without discussing the incident.
   • CPunish the team members who were involved in the response.
   • DDelete all logs and evidence from the incident to free up storage space.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A web server was compromised via a SQL injection vulnerability in a custom application. The incident response team contained the server by isolating it. During eradication, the team discovers that the attacker may have planted a backdoor in the application code. The team has a backup from before the compromise, but the backup may also contain the vulnerability. The team must decide how to eradicate the root cause while minimizing downtime. Which approach is best?

   • ARestore from the backup and then patch the SQL injection vulnerability.
   • BPatch the SQL injection vulnerability and remove the backdoor from the current system.
   • CRebuild the server from a known-good image and reinstall the application with the vulnerability patched.
   • DKeep the server isolated and monitor it for further activity.
   Reveal Solution Discussion Select an answer first