Post-Incident Analysis and Reporting SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A post-incident review reveals that the SOC team's communication during the incident was fragmented, with different analysts sending conflicting updates to management. Which recommendation would best address this issue in the incident report?

   • ARecommend that all analysts communicate directly with management to keep them informed.
   • BDesignate a single incident commander to be the sole point of contact for all external communications.
   • CSuggest that management stop asking for updates during incidents.
   • DAdvise the team to use email instead of chat for all incident communication.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC team is conducting a post-incident analysis after a successful brute-force attack on a VPN gateway. The team wants to improve future response. Which activity is most directly aligned with the purpose of post-incident analysis?

   • AResetting the compromised account's password and restoring the VPN service
   • BDeleting the VPN logs to free up storage space
   • CBlocking the attacker's IP address at the firewall
   • DIdentifying that the VPN gateway lacked account lockout policies and recommending their implementation
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a DDoS incident, the SOC team restored service quickly. The team lead wants to conduct a post-incident analysis. Which outcome best reflects the primary purpose of this analysis?

   • ADetermine which team member was responsible for the delayed mitigation.
   • BVerify that the DDoS was fully mitigated and close the incident.
   • CCalculate the total cost of the incident for insurance purposes.
   • DIdentify why the mitigation was delayed and update the playbook to improve response time.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC analyst is documenting lessons learned from a malware outbreak. The team successfully contained the spread but failed to detect the initial infection for several days. Which set of lessons learned is most balanced and actionable?

   • ADocument both the successful containment steps and the detection gap, with specific recommendations to improve early detection.
   • BWrite a detailed narrative of the incident without any conclusions or recommendations.
   • CRecord only the detection failure so the team can focus on fixing the problem.
   • DList all tools used during the incident without commenting on their effectiveness.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   After a data breach, the SOC team identifies that the incident occurred because a critical server was missing a security patch. The team wants to integrate this lesson into the organization's processes. Which action best supports continuous improvement?

   • AUpdating the patch management policy to require automated vulnerability scanning and a 72-hour patch SLA for critical systems
   • BDocumenting the incident in the lessons-learned log and taking no further action
   • CConducting a training session on the importance of patching, but not changing any existing procedures
   • DAdding the missing patch to the server and closing the incident ticket
   Reveal Solution Discussion Select an answer first