Enterprise Incident Response Management GEIR Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which role in an enterprise incident response team is primarily responsible for coordinating the overall response effort and making final decisions about response actions?

   • AForensic Analyst
   • BIT Support Technician
   • CIncident Commander
   • DCommunications Lead
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A large enterprise has two simultaneous incidents. Incident A: a phishing campaign has compromised the credentials of 50 employees, but there is no evidence of data access yet. Incident B: a single database server has been defaced with a politically motivated message, but the server contains no sensitive data. The IR team has limited resources and must prioritize. Which incident should be treated as higher severity?

   • ABoth incidents should be treated as the same severity because both involve unauthorized access.
   • BIncident B, because defacement is a clear security breach that is visible to the public.
   • CIncident B, because defacement is easier to remediate and therefore should be handled first.
   • DIncident A, because compromised credentials of 50 employees represent a broader potential for lateral movement and data breach.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst detects unusual outbound traffic from a database server to an unknown external IP address. The analyst suspects data exfiltration but is not certain. According to the incident response lifecycle, what should the analyst do NEXT?

   • ADocument the observation and continue monitoring to see if the traffic pattern changes.
   • BEscalate the alert to the incident response team and declare a formal incident.
   • CPerform initial triage to confirm whether the activity is malicious and assess its potential impact.
   • DImmediately disconnect the database server from the network to prevent further data loss.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company's incident response team is triaging a potential data breach. The team has identified that a database containing customer PII may have been accessed by an unauthorized party. The database is critical to business operations, and the team is unsure if the access was successful. The incident commander must decide how to prioritize the response. Which action should the incident commander take?

   • AWait for confirmation that the access was successful before initiating a full response.
   • BClassify the incident as low-severity because the access may not have been successful.
   • CTreat the incident as a high-severity event and initiate containment and investigation immediately, while communicating with key stakeholders.
   • DFocus on eradicating the threat before containing it to prevent further access.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During an active ransomware incident, the IR team has confirmed that the attacker has not yet exfiltrated data. The CEO wants to know if the company should pay the ransom to prevent data release. The IR lead must provide guidance. What is the MOST appropriate recommendation?

   • ARecommend against paying the ransom because there is no guarantee the attacker will release the data or provide a working decryptor.
   • BRecommend paying the ransom only if the attacker provides proof of data deletion.
   • CRecommend paying the ransom because the company has cyber insurance that will cover the cost.
   • DRecommend paying the ransom quickly to minimize downtime and prevent data release.
   Reveal Solution Discussion Select an answer first