Enterprise Environment Incident Response GCFA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A ransomware incident has been confirmed on a segment of the corporate network. The incident commander needs to notify stakeholders without causing panic or leaking sensitive details. Which communication approach is most appropriate during the initial containment phase?

   • ASend a detailed technical briefing to all employees explaining the ransomware variant and indicators of compromise.
   • BInform only the executive leadership and legal team, keeping all other departments unaware until containment is complete.
   • CPost updates on the company's public social media channels to keep customers informed as soon as possible.
   • DUse pre-defined communication templates to send role-specific updates to executives, legal, IT operations, and affected business units.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   After a phishing incident, the CISO wants to evaluate the effectiveness of the incident response team. Which metric would best measure the team's ability to limit the impact of the incident?

   • AMean time to contain (MTTC) the affected mailboxes and endpoints.
   • BTotal cost of the phishing simulation campaign.
   • CNumber of phishing emails reported by users.
   • DMean time to detect (MTTD) for the phishing email.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An IR team wants to report to executive management on the effectiveness of the incident response process after a major incident. Which metric would be most useful for executives to understand the business impact?

   • AThe number of SIEM alerts generated during the incident.
   • BThe total hours spent by IR team members.
   • CThe names of the malware families involved.
   • DEstimated financial loss due to downtime and recovery costs.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A large enterprise has a decentralized IR structure where each business unit has its own IR team. A cross-business-unit incident is detected, and the teams are not coordinating effectively, leading to duplicated efforts and missed containment actions. The enterprise IR policy is being revised. Which change would most improve coordination across business units?

   • AEstablish a central IR coordination center with a clear escalation path and defined roles for each business unit's IR team.
   • BCreate a new policy that mandates all incidents be reported to the CEO directly.
   • CAllow each business unit to handle incidents independently without reporting to a central authority.
   • DRequire all IR teams to use the same forensic tools, but do not change communication procedures.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company's SIEM generates a high volume of alerts, many of which are false positives. The IR team is overwhelmed and missing real incidents. Which approach would most effectively improve the team's ability to detect and respond to genuine threats?

   • ATune the SIEM correlation rules to reduce false positives and prioritize alerts based on risk scoring.
   • BDisable all SIEM alerts and rely solely on manual log review.
   • CReplace the SIEM with a simple spreadsheet to track alerts.
   • DIncrease the number of alerts forwarded to the IR team's email inbox.
   Reveal Solution Discussion Select an answer first