Post-Incident Analysis and Reporting SCE Practice Questions (Page 10)

Questions 46–47

1. 46expert · hard

   A post-incident analysis of a data exfiltration incident reveals multiple contributing factors: an unpatched vulnerability, a weak password, and a lack of network segmentation. The team must determine the primary root cause to prioritize fixes. Which approach is most appropriate?

   • AFocus on the unpatched vulnerability because it is the most technical cause.
   • BConclude that the incident was caused by human error and require stronger passwords.
   • CUse a fishbone diagram to categorize the factors and then apply 5 Whys to each category to identify the deepest systemic cause.
   • DTreat all three factors as equally important and fix them simultaneously.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   After a phishing incident, the SOC team found that the malware was delivered via a malicious attachment. The initial investigation stopped at 'the user clicked the attachment.' The team lead wants to uncover why the email bypassed the gateway and why the user was not blocked. Which approach best supports this deeper investigation?

   • AInterview the user to determine exactly which link they clicked and when.
   • BImmediately update the email gateway rule that allowed the attachment through.
   • CDocument the incident timeline and close the case once the attacker's entry point is confirmed.
   • DConduct a 5 Whys analysis to trace the chain from the click back to the missing gateway rule and the lack of user training.
   Reveal Solution Discussion Select an answer first