Enterprise Incident Response Management GEIR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   During an incident investigation, the response team collects forensic images from servers that may be used in legal proceedings. Which practice is essential to preserve the admissibility of this evidence?

   • ASharing the evidence with all team members without restrictions
   • BDeleting the evidence after the investigation is complete
   • CMaintaining a documented chain of custody
   • DStoring the evidence on the same server it was collected from
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company's OT network is hit by ransomware that encrypts files on several PLC programming workstations. The IR team has isolated the affected segment. The production line is still running because the PLCs themselves were not encrypted, but the engineering team needs the workstations back within 4 hours to make a scheduled product changeover. The IR lead has confirmed the ransomware strain has a known decryptor that is reliable and tested. What should the IR team do FIRST to balance recovery speed with preservation of evidence?

   • AImage the affected workstations, then use the known decryptor to restore them, and retain the images for later analysis.
   • BKeep the systems isolated and wait for law enforcement to arrive before taking any recovery action.
   • CApply the decryptor to the live systems first, then collect memory and disk images from the decrypted systems.
   • DRestore from the most recent backup immediately and defer all forensic collection until after the production changeover.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has suffered a ransomware attack that encrypted critical servers. The IR team has confirmed that the attacker exfiltrated a small amount of data before encryption. The company's legal counsel advises that the breach is reportable to regulators. The CEO wants to know if the company should notify customers immediately. What is the MOST appropriate guidance?

   • ANotify customers only after the investigation confirms the specific data that was exfiltrated and the risk to individuals.
   • BDo not notify customers because the amount of data exfiltrated was small.
   • CNotify customers immediately to comply with breach notification laws, even without knowing the exact data involved.
   • DNotify customers only if the media reports the breach first.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During a major incident, the incident response team is activated. The team includes a technical lead, a communications lead, a legal representative, and a business unit representative. The incident commander has just declared the incident and is assigning tasks. Which responsibility is MOST appropriate for the business unit representative?

   • AProvide input on the business impact of containment and recovery decisions.
   • BMake the final decision on whether to shut down a critical system.
   • CLead the technical investigation to identify the root cause of the incident.
   • DDraft the external communication statement for customers and the media.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   After a major incident, the incident response team is conducting a lessons-learned review. The team identifies that the incident response plan was not followed correctly because team members were unsure of their roles and responsibilities. The team lead wants to improve the plan. Which action should the team take?

   • ADocument the lessons learned in the incident report and close the incident without further action.
   • BReplace the incident response team with a new team that has more experience.
   • CIncrease the frequency of incident response training for all team members.
   • DRevise the incident response plan to clearly define roles and responsibilities and conduct regular tabletop exercises to practice the plan.
   Reveal Solution Discussion Select an answer first