Incident Response Lifecycle (preparation to Recovery) SCE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company is preparing its incident response plan. The compliance team requires that all security incidents be reported to regulators within 72 hours. The IR team is small and often handles incidents outside business hours. What preparation activity is most critical to meet this requirement?

   • AEstablish a 24/7 on-call rotation for the IR team and define a communication plan for regulatory reporting.
   • BCreate a detailed incident response playbook for every possible attack type.
   • CPurchase a cyber insurance policy to cover regulatory fines.
   • DDeploy additional endpoint detection tools to reduce the number of incidents.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization is establishing its incident response program. The CISO wants to ensure that the team can respond effectively to incidents without confusion about roles. Which preparation activity is most important to achieve this?

   • ACreate a detailed list of all possible malware families and their signatures.
   • BPurchase the most advanced endpoint detection and response tool available.
   • CWait until the first incident occurs to assign roles based on who is available.
   • DDefine clear roles and responsibilities for each IR team member and document them in the incident response plan.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company's email server was compromised and used to send phishing emails. The IR team removed the malware and patched the vulnerability. Before returning the server to full production, what should the team do during the recovery phase?

   • AChange the server's hostname to avoid being targeted again.
   • BImmediately restore all user mailboxes from backup.
   • CValidate that the server is clean, then gradually reintegrate it while monitoring for anomalies.
   • DPlace the server back online and monitor email logs for any remaining malicious activity.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is an example of an activity performed during the Preparation phase?

   • AReviewing logs to identify suspicious activity
   • BDisconnecting a compromised server from the network
   • CPatching vulnerabilities discovered during the incident
   • DCreating and testing an incident response playbook
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   After a ransomware incident, the incident response team has eradicated the malware and closed the initial access vector. The team is now preparing to restore affected servers from clean backups. The servers host a critical business application that must be available to users as soon as possible. Which recovery approach best balances speed and safety?

   • AKeep the servers offline until the next scheduled maintenance window.
   • BRestore one server, validate it, then gradually restore the others while monitoring.
   • CRestore servers one by one but skip validation to save time.
   • DRestore all servers simultaneously and put them into production immediately.
   Reveal Solution Discussion Select an answer first