Post-Incident Analysis and Reporting SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst is writing the final incident report for a ransomware event. The report must be useful to both the executive leadership and the technical response team. Which section structure best serves both audiences?

   • AA list of all actions taken by each SOC team member with timestamps, but no summary or recommendations
   • BRaw log excerpts, memory dump analysis, and malware reverse-engineering notes only
   • CExecutive summary, detailed technical timeline, evidence list, root cause analysis, and prioritized recommendations
   • DA single narrative paragraph describing the incident, followed by a list of all affected IP addresses
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following should be included in a lessons learned document to make it most useful for future incident response?

   • AA list of all employees' names and their personal contact information
   • BA copy of every log file generated during the incident
   • CA detailed description of the attacker's motives and psychological profile
   • DA summary of what worked well, what did not, and recommended changes
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During a post-incident analysis of a server compromise, the team finds that the server was missing critical patches, the vulnerability scanner was not configured to check that server, and the patch management process had no follow-up for failed patches. Which root cause technique would best help the team identify the underlying process failure?

   • A5 Whys analysis
   • BRisk assessment
   • CEvidence preservation
   • DTimeline reconstruction
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of conducting a post-incident analysis after a security incident has been contained and eradicated?

   • ATo identify root causes and improve future incident response capabilities
   • BTo immediately restore all systems to their pre-incident state without further review
   • CTo delete all logs and evidence related to the incident to protect sensitive data
   • DTo assign blame to the team members who failed to prevent the incident
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC team is documenting lessons learned from an incident where the on-call analyst was not notified because the alert was routed to an outdated email distribution list. Which lesson-learned entry is most actionable?

   • AThe incident was contained successfully, and no changes are needed.
   • BThe on-call analyst should check their email more frequently.
   • CThe alert routing list must be reviewed and updated quarterly, and the on-call schedule must be integrated with the alerting system.
   • DThe alerting system is unreliable and should be replaced.
   Reveal Solution Discussion Select an answer first