Enterprise Environment Incident Response GCFA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational company experiences a data breach involving personal data of customers in multiple jurisdictions. The legal team is unsure which data protection authority to notify first. Which factor should most influence the notification decision?

   • AThe jurisdiction where the affected customers reside.
   • BThe location of the company's headquarters.
   • CThe location of the compromised servers.
   • DThe nationality of the incident response team members.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A critical application server is infected with malware and must be restored quickly. The incident response team is coordinating with the business continuity team. Which approach best aligns IR with BC/DR objectives?

   • AForensically image the server before restoring from a known-good backup.
   • BRestore from the most recent backup immediately without imaging.
   • CRebuild the server from scratch without any backup.
   • DKeep the server offline until the full forensic investigation is complete.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization has just detected a malware infection on several workstations. The incident response team is in the containment phase. Which action is most consistent with this phase?

   • AConduct a root cause analysis to determine how the malware entered the environment.
   • BRestore the workstations from backup immediately.
   • CIsolate the affected workstations from the network while preserving them for forensic analysis.
   • DSend a report to management about the incident's impact.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A large enterprise has a security operations center (SOC) that detects a possible lateral movement from a compromised workstation to a database server. The SOC analyst escalates the incident to the incident response team. According to the enterprise IR plan, who is responsible for making the decision to disconnect the database server from the network?

   • AThe database administrator, who can decide independently to disconnect the server.
   • BThe incident response team lead, after consulting with the database owner and following the IR plan's containment procedures.
   • CThe SOC analyst who detected the alert, without further consultation.
   • DThe chief information security officer (CISO), who must personally approve every containment action.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A multinational company discovers a ransomware infection that has encrypted files on several file servers in its European data center. The incident response team has activated the enterprise IR plan. Legal counsel has advised that the breach may trigger GDPR notification obligations. Which communication action should the IR team take first?

   • AEmail all affected customers immediately with details of the ransomware variant and decryption status.
   • BSend a press release to all media outlets to be transparent about the incident.
   • CPost the incident details on the company's internal wiki so all employees are informed.
   • DNotify the data protection officer (DPO) and the legal department so they can assess notification requirements and coordinate with the IR team.
   Reveal Solution Discussion Select an answer first