Enterprise Incident Response Management GEIR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare organization in the United States experiences a data breach involving protected health information (PHI). The incident response team has confirmed the breach and is preparing to respond. Which legal or regulatory requirement should the team consider FIRST?

   • AThe GDPR, which requires notification to the supervisory authority within 72 hours, because the organization may have EU customers.
   • BThe California Consumer Privacy Act (CCPA), which requires notification to California residents within 30 days.
   • CThe HIPAA Breach Notification Rule, which requires notification to affected individuals and the Department of Health and Human Services without unreasonable delay.
   • DThe Sarbanes-Oxley Act, which requires disclosure of material events to the SEC.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a major incident, the IR team lead needs to ensure that the board of directors receives timely updates. Which role is BEST suited to prepare these updates?

   • AThe legal counsel, who can advise on regulatory reporting requirements.
   • BThe forensic analyst, who can provide detailed technical findings.
   • CThe communications lead, who manages external messaging.
   • DThe incident commander, who has the full picture of the incident and can prioritize information for the board.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An IR team is responding to a suspected data breach. The team has identified the initial access vector and is confident that the attacker is still active in the environment. The team lead must decide whether to contain immediately or continue monitoring to gather more intelligence. What is the MOST important consideration?

   • AThe risk of continued data exfiltration versus the value of additional intelligence on the attacker's activities.
   • BThe cost of containment tools versus the cost of continued monitoring.
   • CThe availability of forensic analysts to analyze the intelligence gathered.
   • DThe preference of the incident commander for a particular response strategy.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is responding to a ransomware incident. The incident response team has been activated, and the incident commander is assigning roles. The team includes a technical lead, a communications lead, a legal representative, and a business unit representative. The incident commander needs to ensure that the response is coordinated and that all stakeholders are informed. Which responsibility should the incident commander delegate to the communications lead?

   • AAssess the business impact of the ransomware and determine which systems are critical.
   • BLead the technical investigation to identify the ransomware variant and the entry point.
   • CMake the final decision on whether to pay the ransom.
   • DCoordinate all internal and external communications, including updates to employees, customers, and regulators.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During triage, an incident is classified as 'high severity' because it involves the compromise of a database containing customer payment card data. Which action should the response team take first?

   • APrioritize containment and immediate response actions
   • BAssign the incident to a junior analyst for routine handling
   • CDelete all logs related to the incident to protect privacy
   • DWait for the next business day to begin the investigation
   Reveal Solution Discussion Select an answer first