Post-Incident Analysis and Reporting SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A post-incident report for a phishing attack that compromised several executive accounts must be communicated to the executive team. The executives are concerned about the potential impact on customer trust and regulatory compliance. The SOC manager must present the findings. Which communication strategy is most effective?

   • APresent a concise summary of the incident, the business impact, and the recommended security enhancements, using non-technical language.
   • BFocus on the technical root cause and the specific phishing email content.
   • CReassure the executives that the incident was contained and no further action is needed.
   • DProvide the full technical report with all email headers and malware analysis details.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A post-incident review of a malware infection found that the SOC team lacked a documented procedure for isolating infected hosts, causing a delay in containment. The team wants to integrate this lesson into the organization. However, the security budget is limited, and the team is already overworked. Which approach best balances improvement with resource constraints?

   • ARequire all SOC analysts to attend an external incident response training course.
   • BAdd the lesson to the incident report and defer action until the next budget cycle.
   • CPurchase an automated endpoint isolation tool that can contain infections instantly.
   • DCreate a concise one-page isolation playbook and incorporate it into the next scheduled tabletop exercise.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary goal of communicating post-incident findings to technical staff?

   • ATo reassure them that no changes are needed to current practices
   • BTo provide a high-level summary without any technical specifics
   • CTo provide actionable technical details that help them improve detection and response
   • DTo assign blame for the incident to specific team members
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC analyst is investigating a malware outbreak that started on a single workstation and spread to multiple servers. The analyst must determine the underlying cause of the spread. Which approach is most aligned with root cause analysis?

   • AReviewing the firewall logs to determine which ports were used during the spread
   • BFocusing only on the malware's command-and-control server to identify the attacker's identity
   • CUsing a fishbone diagram to categorize potential causes into categories such as people, process, technology, and environment
   • DReimaging all affected systems and restoring from backups to return to normal operations
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During the post-incident review of a DDoS attack, the SOC team notes that the incident response plan did not include a clear escalation path to the ISP. The team wants to document this finding. What is the most effective way to capture this lesson?

   • ADeleting the incident logs to free up storage space
   • BAdding a section to the lessons-learned report that describes the gap, its impact on the response, and a recommendation to add ISP escalation procedures to the plan
   • CRecording the incident in the ticketing system as 'resolved' with a note that the ISP was contacted
   • DVerbally mentioning the issue during the next team meeting without writing it down
   Reveal Solution Discussion Select an answer first