Incident Assessment GCIL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An incident response team is documenting a phishing incident that led to a credential compromise. The team needs to ensure the documentation supports the incident tracking system and post-incident review. Which information is most important to include?

   • AThe color scheme and design of the phishing email.
   • BThe exact time the phishing email was opened and the subsequent actions taken by the user.
   • CThe name of the employee who reported the phishing email.
   • DThe number of other employees who received the same phishing email.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An incident responder is documenting a phishing incident where a user provided their credentials on a fake login page. The responder needs to record the evidence collected. Which documentation entry is most appropriate?

   • AThe user was careless and should be retrained on phishing awareness.
   • BThe user's password was compromised and must be reset immediately.
   • CThe fake login page URL, the timestamp of the credential submission, and the user's account name.
   • DThe phishing email was sent from a foreign country.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A manufacturing company discovers that a ransomware variant has encrypted files on a file server containing CAD drawings for a product scheduled to launch in two weeks. The server is not backed up. The incident response team is assessing impact. Which factor should be prioritized in the impact assessment?

   • AThe potential revenue loss from delaying the product launch and the cost to recreate the CAD drawings.
   • BThe cost of the ransomware payment demanded by the attackers.
   • CThe time since the ransomware was first detected on the network.
   • DThe number of files encrypted on the file server.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A retail company's point-of-sale (POS) system is suspected of being compromised. The initial assessment shows that credit card data may have been exposed. The incident commander needs to communicate with the company's legal counsel. What is the most appropriate information to share?

   • AThe scope of potentially exposed data, the timeframe of the compromise, and the systems involved.
   • BThe estimated cost of the investigation so far.
   • CThe full technical details of the malware analysis and the command-and-control infrastructure.
   • DThe names of all employees who used the POS system in the last month.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's incident response team is assessing a potential incident involving a compromised user account. The account has been used to access sensitive files, but the team is unsure if the access was malicious or accidental. Which approach is most appropriate for the initial assessment?

   • ATreat the access as a potential incident and conduct a thorough investigation to determine the intent and scope.
   • BImmediately revoke the user's access and reset their password.
   • CDismiss the access as accidental because the user has a legitimate need to access the files.
   • DWait for the user to explain the access before taking any action.
   Reveal Solution Discussion Select an answer first