Incident Preparation GCIL Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   An organization's incident response team has a documented toolkit that includes a network analyzer, a forensic workstation, and a malware analysis sandbox. The team recently discovered that the forensic workstation's software is outdated and cannot analyze the latest disk formats. What should the incident leader do to ensure tool readiness?

   • AUpdate the forensic workstation's software and verify that it can analyze the latest disk formats through a test.
   • BPurchase a new forensic workstation and keep the old one as a backup.
   • CWait until the next incident to see if the forensic workstation can handle the disk formats.
   • DRemove the forensic workstation from the toolkit because it is outdated.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company's incident response team is selecting a new endpoint detection and response (EDR) tool. The team needs to ensure the tool can be deployed quickly during an incident and that analysts can access it remotely. The budget is limited, and the team wants to avoid long procurement cycles. Which approach best meets these needs?

   • APre-negotiate a cloud-based EDR solution with a rapid deployment option and remote access capabilities.
   • BPurchase a perpetual license for an on-premises EDR tool and install it on all endpoints now.
   • CUse free open-source tools that the team can configure during an incident.
   • DWait until an incident occurs, then purchase the best available tool at that time.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An organization's incident response plan was last updated three years ago. Since then, the company has migrated to a cloud-based infrastructure and adopted a DevOps model. The incident leader is reviewing the plan for continuous improvement. What is the most important factor to consider when updating the plan?

   • AThe plan should be updated only by the original author who wrote it three years ago.
   • BThe plan should remain unchanged to maintain consistency with historical incident response procedures.
   • CThe plan must reflect the current technology stack, including cloud services and DevOps processes, and be tested against new threat scenarios.
   • DThe plan should focus only on the new cloud infrastructure and remove all references to legacy on-premises systems.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   After a significant data breach, an organization's incident response team conducted a thorough post-incident review. The review identified that the response plan did not include a clear communication strategy for notifying external stakeholders, and that several team members were unfamiliar with the plan's escalation procedures. What should the incident leader do to ensure continuous improvement of preparation?

   • AConduct another post-incident review in six months to see if the issues resolve themselves.
   • BReplace the incident response team with new members who are already familiar with escalation procedures.
   • CPurchase a new incident management platform to automate the escalation process and eliminate the need for training.
   • DUpdate the incident response plan to include a stakeholder communication annex and schedule a training session to review the escalation procedures.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A multinational organization maintains a single incident response plan that designates the global CISO as the sole incident commander for all incidents. After a regional ransomware event, the European response team waited over four hours for approval to contain the infection because the CISO was in a different time zone. The plan is now being revised. Which change best addresses the identified deficiency while preserving centralized governance?

   • AImplement a tiered command structure with pre-authorized regional incident commanders who can declare an emergency and execute containment actions, with the global CISO notified immediately.
   • BRevise the plan to allow any team member to contain an incident without approval, with after-the-fact reporting to the CISO within 24 hours.
   • CRequire all incident commanders to carry satellite phones so the global CISO can always be reached regardless of location or time zone.
   • DCreate a separate incident response plan for the European region with its own command structure, independent of the global plan.
   Reveal Solution Discussion Select an answer first