4.03 Determine the Appropriate Incident Response Plan Given Specific Attack Details 401 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During triage, an analyst classifies an incident as high severity because it involves a data breach of customer records. Which factor most directly influenced this classification?

   • AThe number of security tools deployed
   • BThe impact on sensitive data
   • CThe time of day the attack occurred
   • DThe source of the attack
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   After resolving a phishing incident, the incident response team identifies that the email filtering rules were insufficient. What is the most appropriate action to improve the incident response plan?

   • ABlame the employee who clicked the link
   • BUpdate the email filtering rules and document the lesson learned
   • CIgnore the finding because the incident is over
   • DDelete all logs from the incident
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   After a major incident, a company's incident response team conducts a lessons learned review. They find that the response was hindered by a lack of clear roles and responsibilities, and that some team members did not know who to report to. What is the most effective improvement to the incident response plan?

   • AImplement a new incident management software tool
   • BCreate a detailed incident response team chart with defined roles, responsibilities, and reporting lines
   • CIncrease the number of team members to ensure more people are available
   • DSchedule more frequent incident response drills
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A mid-sized company experiences a minor malware infection on a single employee's laptop. The malware is a known trojan that has been contained and removed. The incident response team has confirmed no data exfiltration. According to the incident response plan, what is the appropriate escalation and communication step?

   • ANotify the executive leadership and legal department immediately
   • BContact law enforcement to report the incident
   • CIssue a press release to inform the public
   • DDocument the incident in the incident log and inform the IT helpdesk for awareness
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company's security team detects that an attacker has been using a legitimate employee's credentials to access the company's HR system and view salary information. The employee is on vacation and has not been using the system. The credentials were not phished; they appear to have been obtained from a previous data breach. What is the most likely classification of this incident?

   • ADDoS attack because the HR system is being overwhelmed with requests
   • BData breach because sensitive HR data is being accessed without authorization
   • CInsider threat because the credentials belong to an employee
   • DMalware infection because the credentials were likely stolen by malware
   Reveal Solution Discussion Select an answer first