Incident Preparation GCIL Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization is preparing for a potential cyber incident. The incident response team has identified that their current toolset lacks the ability to collect and analyze logs from a variety of sources, including cloud services and on-premises systems. The team also needs to ensure that analysts are trained on the new tool. The budget is tight, and the organization wants to minimize the time to deploy the tool. Which approach best balances these constraints?

   • ASelect a cloud-based SIEM that supports multiple log sources, and provide just-in-time training to analysts during the deployment.
   • BBuild an in-house log management system using open-source components.
   • CPurchase a commercial SIEM with a long implementation timeline and schedule comprehensive training after deployment.
   • DUse a combination of free tools and manual log analysis processes.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary goal of incident response training and awareness programs?

   • ATo replace the need for an incident response plan
   • BTo provide a break from regular work duties
   • CTo test the security of the organization's network
   • DTo ensure personnel understand their roles and can respond effectively during an incident
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of conducting a post-incident review?

   • ATo identify lessons learned and improve future incident response efforts
   • BTo determine the financial cost of the incident only
   • CTo delete all evidence related to the incident
   • DTo assign blame to individuals for the incident
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's incident response team is preparing to respond to a potential data breach. The team has access to a forensic imaging tool, but only one team member is trained to use it. The incident leader is concerned about the team's readiness. Which action should be taken to improve tool readiness?

   • ARely on the single trained team member to handle all forensic imaging during an incident.
   • BPurchase a second forensic imaging tool so there is a backup if the first one fails.
   • CProvide training to additional team members on the forensic imaging tool and conduct a practice exercise to verify proficiency.
   • DRemove the forensic imaging tool from the toolkit because it is too complex to use.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services firm is updating its incident response toolkit. The team currently uses a legacy on-premises SIEM, but the CISO wants to add a cloud-native SOAR platform to automate containment actions. The compliance team requires that all security logs remain within the country of operation. Which procurement approach satisfies both the operational and compliance requirements?

   • AUse the existing SIEM's scripting features to automate containment and avoid purchasing a new SOAR platform.
   • BDeploy the SOAR platform on-premises and disable all cloud connectivity to ensure logs never leave the facility.
   • CSelect a SOAR vendor that offers a regional cloud deployment within the required country and integrate it with the existing on-premises SIEM.
   • DReplace the on-premises SIEM with a global cloud SIEM and use its built-in automation features.
   Reveal Solution Discussion Select an answer first