Enterprise Incident Response Management GEIR Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a large-scale incident, the IR team lead needs to ensure that the legal department is informed of any evidence that may be relevant to potential litigation. Which role is BEST suited to handle this coordination?

   • AThe incident commander, who has overall authority and can prioritize legal notifications.
   • BThe communications lead, who manages external messaging and can inform legal.
   • CThe legal counsel embedded in the IR team, who can advise on legal holds and evidence preservation.
   • DThe forensic analyst, who can determine which evidence is most relevant to the case.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A US-based company experiences a breach that affects the personal data of EU residents. The company has no physical presence in the EU but offers services to EU customers. The IR team is unsure whether the GDPR applies. What is the MOST accurate assessment?

   • AThe GDPR applies only if the breach involves more than 500 EU residents.
   • BThe GDPR applies because the company offers services to EU residents, even without a physical presence in the EU.
   • CThe GDPR does not apply because the company is based in the US.
   • DThe GDPR applies only if the company has a legal entity or office in the EU.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is responding to a ransomware incident that has affected a significant portion of its infrastructure. The incident commander has decided to pay the ransom to restore operations quickly. The legal team has advised that paying the ransom is not illegal in the company's jurisdiction but may have regulatory implications. Which action should the incident commander take regarding communication?

   • ACommunicate the decision to key stakeholders, including executive leadership, legal, and affected business units, with a clear rationale.
   • BAnnounce the decision publicly to be transparent with customers and the media.
   • CDelay communication until after the ransom is paid and systems are restored.
   • DKeep the decision confidential to avoid panic and only inform the technical team responsible for the payment.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of establishing a communication plan before an incident occurs?

   • ATo assign blame for the incident after it is resolved
   • BTo guarantee that no information about the incident is shared with anyone
   • CTo ensure that the right information reaches the right stakeholders in a timely and controlled manner
   • DTo replace the need for incident response procedures
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During a suspected data breach, the incident response team has identified a compromised server that is exfiltrating data to an external IP address. The server is running a critical business application that cannot be taken offline without significant operational impact. The team has network-level visibility and can block traffic at the firewall. Which action should the team take to contain the incident while minimizing business disruption?

   • ABlock the outbound connection to the external IP address at the firewall and continue monitoring the server for other malicious activity.
   • BImmediately shut down the server to prevent further data loss and preserve evidence.
   • CChange the server's DNS settings to redirect the exfiltration traffic to a sinkhole.
   • DDisconnect the server from the network by unplugging the network cable.
   Reveal Solution Discussion Select an answer first