Post-Incident Analysis and Reporting SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC manager must present the findings of a post-incident analysis to the board of directors. The board is concerned about business impact and future risk. Which communication approach is most appropriate?

   • AProvide the full technical report with all log excerpts and malware analysis details.
   • BFocus only on the technical root cause and the specific commands used by the attacker.
   • CSkip the presentation and send the incident report via email for the board to read.
   • DPresent a high-level summary of the incident, business impact, and key recommendations in non-technical language.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC analyst is preparing the final incident report for a malware infection. The report must include a clear timeline of events. Which timeline element is most important to include?

   • AThe time the malware was first detected, the time containment began, and the time the system was fully remediated
   • BThe time the analyst took a coffee break during the investigation
   • CThe time the antivirus vendor released a signature update
   • DThe time the SOC manager last reviewed the incident report
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A lessons-learned review of a ransomware incident reveals that the backup restoration process was successful, but the backups were encrypted because they were stored on the same network segment as the production servers. The team must decide how to document and act on this lesson. Which approach is most effective?

   • ADocument the backup segmentation failure as a critical finding and recommend moving backups to an isolated, offline or immutable storage solution.
   • BConclude that the incident was handled well and no changes are needed.
   • CRecommend purchasing additional backup storage without changing the network architecture.
   • DDocument the successful restoration as the key lesson and note that backups worked.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An incident report for a credential-stuffing attack must be submitted to management. The report includes the timeline, evidence, and actions taken. What additional element is essential to make the report complete and actionable?

   • AThe personal opinions of the analysts about the attacker's motives.
   • BThe names of all employees whose accounts were compromised.
   • CA copy of the organization's incident response policy.
   • DRecommendations to prevent similar attacks, such as enforcing multi-factor authentication.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which component of an incident report is most important for helping stakeholders understand what actions should be taken to prevent similar incidents in the future?

   • AEvidence list
   • BRecommendations
   • CExecutive summary
   • DTimeline
   Reveal Solution Discussion Select an answer first