Incident Response Concepts and Application GCED Practice Questions (Page 10)

Questions 46–50

1. 46application · easy

   A company's incident response playbook for phishing incidents specifies that upon confirmation of a phishing email, the team should quarantine the email, block the sender, and reset the credentials of any user who clicked the link. A user reports a suspicious email, and the analyst confirms it is a known phishing campaign. Which action should the analyst take?

   • AFollow the playbook: quarantine the email, block the sender, and reset credentials if the user clicked the link.
   • BForward the email to all employees as a warning before taking any action.
   • COnly quarantine the email and wait for further instructions from the incident commander.
   • DReset the user's credentials immediately, but do not quarantine the email because the user already reported it.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   During a significant security incident, the incident commander asks the communications lead to provide a status update to executive leadership. The communications lead has detailed technical findings from the lead analyst. What should the communications lead include in the update?

   • AA request for more budget to purchase additional forensic tools.
   • BOnly the number of affected systems and the malware family name.
   • CThe full technical report, including all forensic details and indicators of compromise.
   • DA summary of the incident's impact, current containment status, and expected next steps, avoiding excessive technical jargon.
   Reveal Solution Discussion Select an answer first
4. 48application · easy

   After a security incident, the incident response team has completed the recovery phase and all systems are back to normal. The team is now meeting to discuss what went well and what could be improved. Which phase of the incident response lifecycle are they in?

   • ALessons learned
   • BPreparation
   • CDetection
   • DEradication
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An incident responder in the European Union is handling a data breach that involves personal data of EU citizens. The responder needs to collect evidence from a cloud service provider whose servers are located in the United States. What legal consideration is most important before transferring the evidence?

   • AThe responder must delete all personal data before transferring evidence.
   • BEnsure the transfer complies with GDPR requirements for international data transfers, such as using appropriate safeguards.
   • CThe responder only needs to obtain verbal consent from the data subjects.
   • DNo legal considerations apply because the data is evidence of a crime.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A mid-sized company has a playbook for phishing incidents. During a real phishing attack, the incident commander notices that the playbook's containment step assumes the email gateway can block the sender, but the gateway is misconfigured. What should the incident commander do?

   • AAdapt the playbook by using an alternative containment method, such as disabling the affected user's account.
   • BWait for the gateway to be fixed before taking any action.
   • CSkip containment and proceed directly to eradication.
   • DEscalate to the CEO for a decision on how to proceed.
   Reveal Solution Discussion Select an answer first