Incident Response Concepts and Application GCED Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security operations center receives multiple alerts during a large-scale attack. The incident commander must prioritize which alerts to investigate. Which factor should be the primary consideration?

   • AThe ease of investigating the alert.
   • BThe time of day the alert was generated.
   • CThe potential impact on critical business functions and data confidentiality.
   • DThe number of alerts received.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A financial institution is responding to two simultaneous incidents: (1) a phishing campaign that has compromised the credentials of 50 low-privilege employees, and (2) a suspected malware infection on a server that processes high-value wire transfers. The incident response team has limited resources and must prioritize. Which incident should be handled first?

   • AThe wire transfer server malware, because it directly threatens a critical financial system and could cause significant financial loss.
   • BThe phishing campaign, because it affects more users (50 employees).
   • CBoth incidents simultaneously, splitting the team evenly.
   • DThe phishing campaign, because it is easier to contain.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A regional hospital's IT team detects ransomware on a single administrative workstation in the finance department. The malware has encrypted local files but has not yet spread to the file server. The hospital's incident response plan requires the team to prioritize by impact and urgency. Which action should the team take first?

   • AIsolate the workstation from the network and begin containment.
   • BReboot the workstation to clear the malware from memory.
   • CNotify the hospital's public relations department before any technical action.
   • DRestore the workstation from the most recent backup immediately.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After a security incident is fully contained and eradicated, the incident response team holds a lessons-learned meeting. Which outcome is the primary purpose of this meeting?

   • AAssign blame to individuals who made mistakes during the incident.
   • BCelebrate the team's success without discussing failures.
   • CDocument the incident for insurance claims only.
   • DIdentify improvements to the incident response plan and security controls.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which practice is essential for preserving digital evidence in a forensically sound manner?

   • AWorking on the original evidence to avoid making copies
   • BTurning on the computer to see if it is still running
   • CUsing write-blockers when acquiring evidence from storage media
   • DDeleting irrelevant files to simplify the analysis
   Reveal Solution Discussion Select an answer first