Incident Remediation and Closure GCIL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A hospital's patient record system is infected with ransomware. The system is critical for patient care, and the hospital cannot afford a prolonged outage. The ransomware has encrypted files on the primary server, but backups are available and have been verified. What is the most appropriate long-term containment and recovery approach?

   • ADisconnect the system from the network and continue using it offline.
   • BPay the ransom to obtain the decryption key and then restore the system.
   • CRestore the patient record system from verified backups and apply security patches before reconnecting to the network.
   • DRebuild the system from scratch without using any backups.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   During the lessons-learned review, the team identifies that the incident response plan did not include a clear process for communicating with external stakeholders, such as customers and regulators. The team is divided on whether to update the plan or create a separate communication plan. What is the best course of action?

   • AAssign a single person to handle all communication without documenting the process.
   • BDo not update any plans because the incident is over.
   • CUpdate the incident response plan to include a stakeholder communication process, and document the decision in the lessons-learned report.
   • DCreate a separate communication plan and do not update the incident response plan.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A post-incident review of a denial-of-service (DoS) attack reveals that the organization's incident response plan did not include clear criteria for when to engage the ISP for traffic scrubbing. As a result, the response was delayed. What is the most effective recommendation to improve the incident response process?

   • AConduct a tabletop exercise to test the incident response plan.
   • BAdd predefined triggers and escalation procedures for engaging the ISP to the incident response plan.
   • CPurchase additional bandwidth to absorb future DoS attacks.
   • DTrain all employees on how to recognize a DoS attack.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of defining closure criteria for an incident?

   • ATo assign roles to the incident response team
   • BTo determine when it is safe to formally close the incident
   • CTo identify the root cause of the incident
   • DTo document the timeline of the incident
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After an incident, the incident commander asks for a report that can be used to improve future response efforts. What is the most important element to include in this report?

   • AA summary of the incident's financial impact only.
   • BA copy of the original incident response plan without any changes.
   • CA list of all employees who were involved in the incident response.
   • DA detailed analysis of what went well, what went wrong, and specific recommendations for improvement.
   Reveal Solution Discussion Select an answer first