Use War Rooms for Incident Handling NSE6-FORTISOAR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During an active incident, the response team is using a war room to coordinate. The incident commander wants to ensure that all team members are aware of the latest containment steps and can quickly access the relevant files. What should the team do in the war room?

   • ACreate a separate incident for each containment step.
   • BPost updates and attach relevant files to the war room.
   • CUse the chat feature in the main incident record.
   • DSend emails to each team member with the updates.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A war room is being used for a phishing incident. The incident commander wants to add a new analyst to the war room so they can assist with the investigation. What should the analyst do?

   • ASend the analyst an email with the incident details.
   • BWait for the analyst to request access.
   • CAdd the new analyst as a participant in the war room.
   • DCreate a new war room for the new analyst.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An incident has been resolved, but the incident commander wants to keep the war room active for a few more days to allow for final reporting and potential follow-up questions. However, the SOC manager wants to ensure that no new activity occurs in the war room. What should the analyst do?

   • ARemove all participants from the war room.
   • BClose the war room immediately and archive it.
   • CKeep the war room active but restrict posting permissions to 'Viewer' for all participants.
   • DLeave the war room as is and monitor it for any new activity.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security incident has been fully contained and eradicated. The incident commander wants to preserve the war room's discussion for future reference but no longer needs it to be active. What should the analyst do?

   • ADelete the war room and all its contents.
   • BClose the war room and archive it.
   • CLeave the war room as is for future incidents.
   • DRemove all participants from the war room.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After a major incident is resolved, the incident commander wants to review the war room's activity to assess the team's response. What should the analyst do?

   • AExport the war room data to a PDF for the report.
   • BDelete the war room to ensure no sensitive data remains.
   • CReview the war room's activity log before closing it.
   • DClose the war room immediately to prevent further changes.
   Reveal Solution Discussion Select an answer first