Incident Assessment GCIL Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A regional bank's security operations center receives an alert about a phishing email that bypassed the gateway and was opened by three employees in the finance department. The email contains a link to a credential-harvesting page that is still active. The SOC lead must determine the initial priority. Which action should the SOC lead take first?

   • AIsolate the three finance workstations from the network while preserving the email and link in a forensically sound manner.
   • BBlock the phishing URL at the proxy and mark the alert as a false positive because no credentials were submitted.
   • CReset the passwords of the three employees immediately and document the incident in the ticketing system.
   • DSend a company-wide email warning all employees not to click the link, then wait for the phishing site to be taken down.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is a key consideration when communicating assessment findings to stakeholders?

   • ATailor the communication to the audience's level of technical understanding
   • BDelay communication until the incident is fully resolved
   • CCommunicate only through formal written reports
   • DProvide all technical details to every stakeholder
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A multinational corporation experiences a data breach involving customer data from its European and US operations. The breach affects different data types and jurisdictions. The incident response team must classify the incident for reporting. What is the most appropriate classification approach?

   • AClassify the entire incident as a single data breach with a global impact.
   • BClassify the incident separately for each jurisdiction based on the data types and applicable regulations.
   • CClassify the incident as a low-priority event because it involves customer data, not financial data.
   • DClassify the incident based on the most severe jurisdiction's requirements.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In the incident management lifecycle, what is the primary purpose of incident assessment?

   • ATo assign a permanent classification to the incident for regulatory reporting
   • BTo communicate the incident to external regulators before any internal analysis
   • CTo determine the scope and impact of an incident and inform subsequent response decisions
   • DTo execute the technical containment steps that stop the incident from spreading
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During an incident investigation, a security analyst discovers that an attacker modified a configuration file on a Linux web server. The analyst needs to preserve evidence for potential legal action. Which action is most appropriate?

   • AEdit the configuration file to remove the attacker's changes and then save a copy for evidence.
   • BTake a forensic image of the entire server disk and record SHA-256 hashes of the image and the original file.
   • CEmail the configuration file to the legal department so they can review it immediately.
   • DCopy the configuration file to a USB drive and store it in the incident lead's desk drawer.
   Reveal Solution Discussion Select an answer first