Enterprise Incident Response Management GEIR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which procedure is part of the eradication phase of incident response?

   • ARemoving the attacker's persistence mechanisms from compromised systems
   • BCreating a timeline of the incident
   • CMonitoring network traffic for signs of re-infection
   • DNotifying customers about a data breach
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of a lessons-learned meeting after an incident?

   • ATo identify what went well and what could be improved in the incident response process
   • BTo delete all records of the incident to protect the organization
   • CTo assign blame to team members for mistakes made during the incident
   • DTo immediately resume normal operations without further discussion
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization's IR team has confirmed that a worm is spreading across the network. The team has isolated the affected systems. What is the NEXT step in the containment phase?

   • AIdentify the propagation mechanism and block it at the network level to prevent further spread.
   • BConduct a lessons-learned review to document the incident.
   • CRestore affected systems from backup to resume operations.
   • DBegin eradication by removing the worm from all affected systems.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After a major incident has been contained and eradicated, the incident response team is preparing for the post-incident activities. The team lead wants to ensure that the organization improves its security posture based on the lessons learned. Which activity should be included in the post-incident phase?

   • AImmediately delete all evidence collected during the incident to free up storage space.
   • BSend a final report to the board of directors and close the incident without any further action.
   • CRestore all systems to their pre-incident state and resume normal operations without further review.
   • DConduct a lessons-learned meeting with all stakeholders to review what went well and what could be improved.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare organization discovers that a ransomware attack has encrypted the file server containing patient records. The IR team has contained the spread but has not yet determined whether any data was exfiltrated. The legal department asks the IR lead what information can be shared with the organization's cyber insurance carrier at this point. What is the most appropriate response?

   • AShare the technical indicators of compromise and the containment status, but avoid discussing potential regulatory exposure until the investigation is complete.
   • BShare only the estimated financial impact and do not mention the ransomware or containment actions.
   • CRefuse to share any information with the carrier until law enforcement has completed its investigation.
   • DProvide the carrier with the full forensic report including all patient data that may have been exposed.
   Reveal Solution Discussion Select an answer first