Incident Response Management GCCC Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An organization is planning to test its incident response plan. The organization has a mature security team but has never conducted a coordinated exercise. The goal is to test the team's ability to respond to a phishing attack that leads to credential compromise. The organization wants to minimize the risk of disrupting production. Which exercise type is most appropriate?

   • AA red team exercise that attempts to compromise a production system to test detection and response.
   • BA simulation in a test environment that mimics the phishing attack and the response.
   • CA full-scale exercise that sends a real phishing email to employees and monitors their actions.
   • DA tabletop exercise where the team discusses the scenario and walks through the plan.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization is planning to test its incident response capabilities. The team wants to evaluate decision-making and communication without affecting production systems. Which type of exercise should they conduct?

   • AFull-scale simulation
   • BRed team operation
   • CPenetration test
   • DTabletop exercise
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A manufacturing company's IT team discovers that a ransomware attack has encrypted files on several file servers. The attack appears to have started from a single workstation. The company has backups that are verified to be clean. The incident response team is considering how to recover. Which approach should they take?

   • ARestore all affected servers from backups immediately and then reconnect them to the network.
   • BPay the ransom to obtain the decryption key and then restore the files.
   • CIsolate the affected systems, identify the initial infection vector, and then restore from clean backups after eradicating the threat.
   • DRebuild the file servers from scratch and copy data from the backups without investigating the attack.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company's incident response team has contained a malware infection and eradicated the malware from all affected systems. The team is now ready to recover. What should the team do during the recovery phase?

   • ADelete all affected systems and rebuild them from scratch.
   • BRestore systems from clean backups and verify that they are functioning normally.
   • CImmediately reconnect all systems to the network without verification.
   • DConduct a post-incident review before restoring systems.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   After a significant security incident, the incident response team has completed containment, eradication, and recovery. The team lead wants to ensure that the organization learns from the incident and improves its security posture. Which activity should the team lead prioritize?

   • AAssign blame to the individual who caused the incident.
   • BDelete all evidence related to the incident to reduce legal liability.
   • CConduct a post-incident review meeting with all stakeholders to discuss what happened and identify lessons learned.
   • DImmediately return all systems to normal operation without further analysis.
   Reveal Solution Discussion Select an answer first