Incident Assessment GCIL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A logistics company's warehouse management system (WMS) is infected with ransomware. The WMS is critical for tracking shipments. The company has a backup that is 24 hours old. The incident commander needs to assess the impact. What is the most critical impact to communicate?

   • AThe number of files encrypted by the ransomware
   • BThe operational disruption to shipment tracking and the potential for delayed deliveries
   • CThe financial cost of the ransomware payment demand
   • DThe age of the backup and the potential for data loss
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   After a data breach, a company is preparing its post-incident review. The incident response team has collected extensive evidence, including logs, forensic images, and witness statements. The team is deciding what to include in the final report. What is the most appropriate approach?

   • AInclude all evidence collected, regardless of relevance, to ensure completeness.
   • BInclude only the evidence that supports the incident response team's conclusions.
   • CInclude a summary of key findings, the timeline of events, and recommendations for improvement.
   • DExclude witness statements because they are subjective.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A hospital's security team receives two alerts simultaneously: (1) a workstation in the cardiology department is infected with ransomware that is actively encrypting files, and (2) a low-priority alert about a phishing email that was reported by a user who did not click the link. The hospital has a limited incident response team. Which incident should be prioritized?

   • AThe phishing email, because it could lead to credential compromise if other users clicked the link.
   • BThe ransomware infection, because it is actively causing damage and could affect patient care.
   • CBoth incidents equally, because both require immediate attention.
   • DNeither incident, because the team should wait for more information before acting.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company's incident response team is managing a ransomware incident. The CEO wants to know if the company should pay the ransom. The legal team is concerned about sanctions. The technical team believes the backups are reliable. The incident commander must communicate the assessment to the CEO. What is the most appropriate communication?

   • ARecommend paying the ransom because it is the fastest way to restore operations.
   • BPresent the technical assessment of backup reliability, the legal concerns about sanctions, and the operational impact, then let the CEO decide.
   • CAdvise the CEO not to pay the ransom because it encourages future attacks.
   • DTell the CEO that the decision is too complex and should be made by the technical team.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why do organizations use standard taxonomies for incident classification?

   • ATo replace the need for detailed incident documentation
   • BTo ensure consistent handling and reporting across incidents
   • CTo assign blame to specific individuals
   • DTo automatically resolve incidents without human intervention
   Reveal Solution Discussion Select an answer first