Incident Response Management GCCC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which method is commonly used to detect incidents by analyzing network traffic for malicious patterns?

   • AIntrusion Detection System (IDS)
   • BConfiguration management database
   • CPatch management tool
   • DVulnerability scanner
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   After a major incident, the incident response team conducts a post-incident review. The team identifies several areas for improvement, including faster detection and better communication. The security manager wants to implement improvements. Which approach is most effective?

   • ADocument the lessons learned and file them for future reference.
   • BUpdate the incident response plan and conduct regular tabletop exercises to test the improvements.
   • CHold a single training session for all employees on incident reporting.
   • DPurchase new security tools to automate detection and response.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a significant data breach, the incident response team completes the containment, eradication, and recovery phases. The team is now preparing a lessons-learned report. What is the primary purpose of this report?

   • ATo identify improvements to the incident response process
   • BTo provide a summary for the media
   • CTo assign blame to individuals who made mistakes
   • DTo document the incident for legal purposes only
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In an incident response team, what is the primary responsibility of the Communications/Public Relations lead?

   • AManaging external communications and media inquiries
   • BAuthorizing containment actions
   • CPerforming forensic analysis of compromised systems
   • DMaintaining the incident response plan
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization wants to test its incident response capabilities for a ransomware scenario. The team has never conducted a full-scale exercise. The organization's leadership is concerned about disrupting production systems. Which exercise approach best balances realism and safety?

   • APerform a red team exercise against production systems to test detection and response.
   • BConduct a tabletop exercise with key stakeholders to discuss the response plan.
   • CRun a full-scale simulation with actual ransomware in a test environment.
   • DConduct a functional exercise in a controlled test environment that simulates the ransomware attack without affecting production.
   Reveal Solution Discussion Select an answer first