Post-Incident Analysis and Reporting SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of documenting lessons learned from an incident response effort?

   • ATo create a permanent record that can be used to improve future incident response
   • BTo satisfy the requirement that every incident be reported to the media
   • CTo provide a legal defense in case the organization is sued for negligence
   • DTo assign performance ratings to individual team members
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An incident report must be shared with legal counsel, the CISO, and the IT helpdesk. Each audience needs different information. What is the most effective way to structure the report?

   • ASend the raw logs and evidence to all parties and let them draw their own conclusions.
   • BPublish the report on the company intranet for all employees to read.
   • CCreate a single report with an executive summary, technical details, and a legal appendix, and distribute it to all parties.
   • DWrite three completely separate reports tailored to each audience.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC analyst must communicate the findings of a post-incident analysis to the IT operations team, which is responsible for implementing the recommended security controls. Which communication format is most appropriate?

   • AA technical briefing that includes the specific vulnerabilities exploited, the recommended configuration changes, and the priority order for implementation
   • BA one-page executive summary that focuses on the financial impact of the incident
   • CA verbal update during a team meeting without any written documentation
   • DA press release announcing the incident to the public
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can lessons learned from an incident be integrated into an organization's security training program?

   • ABy keeping training materials unchanged to maintain consistency
   • BBy deleting all training records to avoid confusion
   • CBy updating training materials to include real-world examples and new response procedures
   • DBy limiting training to only the incident response team
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A post-incident report reveals that a misconfigured SIEM rule caused a delayed detection. The SOC manager must communicate this to the IT operations team, which manages the SIEM. Which message is most actionable for that audience?

   • ASummarize the incident in business terms and ask the team to review the SIEM generally.
   • BEscalate the issue to the IT director without informing the operations team.
   • CProvide the specific rule ID, the misconfiguration, and a recommended fix, and offer to collaborate on testing.
   • DState that the SIEM is unreliable and should be replaced.
   Reveal Solution Discussion Select an answer first