Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is reviewing its incident response program. The security manager notices that during a recent incident, the team struggled to identify which systems were affected and had to manually search for contact information for key stakeholders. Which phase of the incident response lifecycle, if improved, would most directly address these issues?

   • AIdentification
   • BContainment
   • CLessons Learned
   • DPreparation
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During which phase of the incident response lifecycle does the response team focus on removing the root cause of the incident from affected systems?

   • AEradication
   • BLessons Learned
   • CContainment
   • DRecovery
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a phishing attack compromised several user workstations, the incident response team has completed eradication by cleaning the affected systems and resetting compromised credentials. The team is now in the recovery phase. Which action is most appropriate to ensure the systems are safe to return to production?

   • AValidate that the systems are clean by running antivirus scans and checking for indicators of compromise.
   • BReconnect the systems to the network and immediately allow users to log in.
   • CKeep the systems offline indefinitely to avoid any risk.
   • DRestore the systems from the most recent backup without checking the backup for malware.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is establishing an incident response capability. The security team has limited budget and wants to ensure they can detect and respond to incidents effectively. They have already purchased a SIEM and EDR tools. Which additional preparation activity is most critical to ensure the team can act effectively during an incident?

   • AHiring more security analysts to monitor alerts 24/7.
   • BConducting a penetration test to identify vulnerabilities.
   • CPurchasing additional security tools to cover every possible attack vector.
   • DDocumenting roles, responsibilities, and communication procedures in an incident response plan.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A web application was compromised through a vulnerable plugin. The IR team removed the malware and patched the plugin, but the application must be restored to full production. Which step should be included in the recovery phase to ensure the application is safe to return to service?

   • ARun a vulnerability scan and verify that the patched plugin is active before placing the application back in production.
   • BImmediately put the application online to minimize business disruption.
   • CRe-enable all user accounts that were disabled during containment.
   • DRestore the application from the last known-good backup taken before the incident.
   Reveal Solution Discussion Select an answer first