Incident Response Management GCCC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An employee at a financial institution receives a suspicious email with an attachment. The employee opens the attachment, and the computer begins to behave strangely. The employee reports the issue to the IT help desk. What should the help desk do first?

   • AAsk the employee to restart the computer to see if the issue resolves.
   • BDisconnect the computer from the network and report the incident to the security team.
   • CRun a full antivirus scan and wait for the results.
   • DIgnore the report because it is likely a false positive.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which strategy is used to prevent an incident from spreading while preserving evidence?

   • AIsolating affected systems from the network
   • BRebuilding systems from scratch
   • CDeleting malicious files immediately
   • DDisabling user accounts
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A hospital's IT department detects a ransomware attack that is encrypting files on multiple servers. The attack is spreading rapidly. The hospital's incident response team must prioritize their actions. Which incident should be handled first?

   • AA phishing email reported by a single user that was quarantined by the email gateway.
   • BThe ransomware attack affecting multiple servers and potentially impacting patient care systems.
   • CA malware infection on a single workstation that is isolated and not spreading.
   • DA minor policy violation where an employee accessed a social media site during work hours.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a tabletop exercise in incident response testing?

   • AA review of incident response policies
   • BA discussion-based session where team members walk through a hypothetical incident scenario
   • CA full-scale simulation with live systems and real malware
   • DA test of backup restoration procedures
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's incident response team has just completed the containment phase of a malware outbreak. The malware has been isolated to a few systems, and the team is confident that it has not spread further. What should the team do next?

   • ABegin the eradication phase by removing the malware from affected systems and addressing the root cause.
   • BImmediately restore all systems from backups without further action.
   • CDeclare the incident over and return to normal operations.
   • DConduct a post-incident review before completing eradication.
   Reveal Solution Discussion Select an answer first