4.02 Determine the Appropriate Proactive Security Response Plan 401 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a well-documented incident response plan, but during a recent minor incident, the response team was unsure of their roles and the plan was not followed correctly. The security team wants to improve the plan's effectiveness. Which approach would be most effective?

   • AConduct regular tabletop exercises and provide role-specific training to all incident response team members.
   • BRewrite the plan to be more detailed and comprehensive.
   • CIncrease the frequency of security awareness training for all employees.
   • DAssign a single person to manage all incidents.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A healthcare organization is developing an incident response plan. They want to ensure that the plan is proactive and includes mechanisms to detect incidents early and to test the plan regularly. Which combination of elements should be included in the plan?

   • AA communication plan and a public relations strategy.
   • BA detailed response procedure for each phase, integrated monitoring tools, and scheduled tabletop exercises.
   • CA set of forensic tools and a legal team on retainer.
   • DA list of emergency contacts and a backup of critical systems.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of a security awareness and training program?

   • ATo reduce human errors that can lead to security incidents
   • BTo eliminate the need for incident response
   • CTo ensure that all employees become security experts
   • DTo replace technical security controls
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a security awareness program, but recent phishing simulations show that employees are still clicking on malicious links. The security team wants to improve the program's effectiveness. Which approach would be most effective?

   • AIncrease the frequency of phishing simulations without providing feedback.
   • BReplace the training program with a technical solution such as email filtering.
   • CMake the training mandatory only for new employees.
   • DImplement a continuous training program with regular simulated phishing exercises and provide immediate feedback to employees.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A university is developing an incident response plan. They want to ensure that the plan includes steps to detect incidents early and to train staff on their roles. Which components should be included?

   • AA business continuity plan and disaster recovery procedures.
   • BA detailed forensic analysis procedure and evidence handling guidelines.
   • CA list of external security consultants and their contact information.
   • DMonitoring tools and alerting procedures, along with role-specific training for incident response team members.
   Reveal Solution Discussion Select an answer first