Enterprise Environment Incident Response GCFA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A manufacturing company's OT network is hit by a wiper malware that is corrupting programmable logic controllers (PLCs). The IR team is in the containment phase. The company's business continuity plan (BCP) requires that production lines resume within 4 hours to meet contractual obligations. Which action best aligns IR containment with BCP objectives?

   • AShut down all production lines and keep them offline until the full forensic investigation is complete.
   • BErase all PLCs and reinstall firmware from the vendor's website without checking for backdoors.
   • CImmediately reconnect all OT devices to the IT network to allow the SIEM to monitor them centrally.
   • DIsolate the affected OT segments from the IT network and restore PLCs from known-good backups while monitoring for re-infection.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which legal requirement most directly impacts how an enterprise incident response team handles personal data during an investigation?

   • ASarbanes-Oxley Act (SOX)
   • BHealth Insurance Portability and Accountability Act (HIPAA)
   • CPayment Card Industry Data Security Standard (PCI DSS)
   • DGeneral Data Protection Regulation (GDPR)
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After a phishing incident that compromised several user accounts, the IR team wants to measure how quickly they detected and responded. The team has timestamps for when the phishing email was sent, when the first alert fired, when the incident was declared, and when the compromised accounts were disabled. Which metric best reflects the team's detection capability?

   • ATime from first alert to incident declared
   • BTime from incident declared to accounts disabled
   • CTime from email sent to first alert fired
   • DTotal number of phishing emails reported by users
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company's business continuity plan requires that a critical application be restored within four hours. The incident response team has identified that the application's data is encrypted by ransomware. The backups are also encrypted. Which action best aligns with both IR and BC objectives?

   • AActivate the disaster recovery site and fail over to a known-good replica.
   • BPay the ransom to obtain the decryption key and restore the data.
   • CDeclare the application unrecoverable and accept the loss.
   • DRestore from the encrypted backups after removing the encryption.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During an incident involving personal data of EU citizens, the legal team asks the IR team to preserve evidence in a way that satisfies potential regulatory scrutiny. Which action is most important to comply with legal and regulatory requirements?

   • ATransfer all evidence to a cloud storage location outside the EU for safekeeping.
   • BShare the evidence with other organizations in the same industry to help them protect themselves.
   • CDocument the chain of custody for all collected evidence and restrict access to authorized personnel.
   • DDelete all personal data from the compromised systems to minimize exposure.
   Reveal Solution Discussion Select an answer first