Enterprise Incident Response Management GEIR Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which document is typically produced after an incident to provide a detailed account of the incident, the response actions taken, and recommendations for improvement?

   • ANetwork diagram
   • BMarketing brochure
   • CVendor invoice
   • DIncident response report
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which sequence correctly represents the standard incident response lifecycle phases as commonly defined in enterprise IR frameworks?

   • ADetection, Analysis, Preparation, Containment, Eradication, Recovery
   • BPreparation, Detection and Analysis, Containment, Eradication, Recovery, Post-Incident Activity
   • CPreparation, Containment, Detection, Eradication, Recovery, Post-Incident Activity
   • DDetection, Containment, Preparation, Eradication, Recovery, Post-Incident Activity
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which action is an example of a containment procedure during incident response?

   • AConducting a lessons-learned meeting
   • BRestoring data from backups
   • CDeleting malware from affected systems
   • DIsolating an infected host from the network
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which combination of factors is most commonly used to classify the severity of an incident during triage?

   • ANumber of affected users and time of day
   • BImpact and urgency
   • CAttacker's skill level and motivation
   • DCost of security tools and team size
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is responding to a data breach that involves customer credit card information. The breach was discovered by an external security researcher who reported it to the company. The company's legal team has advised that the breach may trigger notification requirements under multiple regulations, including state data breach laws and payment card industry (PCI) requirements. The incident commander must coordinate the response. Which action should the incident commander take FIRST?

   • AImmediately notify the payment card brands and the acquiring bank to comply with PCI requirements.
   • BContact the external security researcher to obtain more details about the breach before taking any action.
   • CConvene the incident response team, including legal, communications, and technical leads, to assess the scope of the breach and determine applicable notification requirements.
   • DIssue a public statement to inform customers about the breach and potential impact.
   Reveal Solution Discussion Select an answer first