Enterprise Incident Response Management GEIR Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   An organization has just experienced a minor security incident that was quickly contained. The IR team is now in the post-incident phase. Which activity is MOST appropriate for this phase?

   • ADelete all logs related to the incident to free up storage space.
   • BConduct a lessons-learned review to identify improvements to the incident response process.
   • CMove on to the next task without any formal post-incident activities.
   • DImmediately update the incident response plan based on the incident without a formal review.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company is responding to a malware outbreak that has infected several servers and workstations. The incident response team has identified the malware and has a containment plan that involves isolating affected systems. However, some affected systems are critical to business operations and cannot be isolated without causing significant disruption. The team must balance containment with business continuity. Which approach should the team take?

   • ALeave all affected systems running and focus on eradicating the malware from the network.
   • BIsolate the non-critical affected systems immediately and implement enhanced monitoring on the critical systems while developing a plan to safely contain them.
   • CShut down the entire network to prevent the malware from spreading further.
   • DIsolate all affected systems immediately, including critical systems, to prevent further spread of the malware.
   Reveal Solution Discussion Select an answer first