Enterprise Environment Incident Response GCFA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A healthcare organization is responding to a suspected breach of patient data. The IR team has identified a compromised server that may contain PHI. Legal counsel has stated that the incident may be subject to HIPAA breach notification rules. The team needs to preserve evidence while continuing to provide patient care services. The server is a legacy system that cannot be taken offline. Which approach best satisfies both forensic and regulatory requirements?

   • ACopy the server's data to a USB drive and give it to the compliance officer for safekeeping.
   • BDelete all patient data from the server to prevent further exposure.
   • CTake the server offline immediately to preserve evidence, even though it will disrupt patient care.
   • DPerform a live forensic acquisition of the server's memory and disk to an external forensic server, hash the images, and document the chain of custody.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which technology is specifically designed to collect and analyze security events from multiple sources across an enterprise in real time?

   • AEndpoint Detection and Response (EDR)
   • BSecurity Information and Event Management (SIEM)
   • CForensic imaging tool
   • DNetwork Intrusion Detection System (NIDS)
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which metric is most useful for evaluating the effectiveness of an enterprise incident response team's detection capabilities?

   • ANumber of false positives
   • BMean time to detect (MTTD)
   • CMean time to respond (MTTR)
   • DCost per incident
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During an enterprise incident, which communication channel is most appropriate for real-time coordination among incident responders who are geographically dispersed?

   • ADedicated incident response chat channel
   • BFormal written report
   • CEmail distribution list
   • DPublic social media post
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   During a major incident, the incident commander is receiving conflicting information from the technical team and the business unit. The technical team reports that the attack is contained, but the business unit says critical systems are still unavailable. Which action should the incident commander take first?

   • AConvene a meeting with both teams to reconcile the reports and establish a common operational picture.
   • BEscalate the issue to executive leadership immediately.
   • CDeclare the incident over and close the incident response process.
   • DTrust the technical team's assessment and begin the recovery phase.
   Reveal Solution Discussion Select an answer first