Enterprise Incident Response Management GEIR Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization's SIEM alerts on suspicious outbound traffic from a database server. The IR team confirms that an attacker has been extracting data for the past 6 hours. The team has isolated the server and stopped the exfiltration. According to the incident response lifecycle, what is the NEXT major phase the team should formally enter?

   • ARecovery, to restore the database server to normal operation.
   • BLessons Learned, to document the incident and improve future response.
   • CPreparation, to update the incident response plan based on this incident.
   • DEradication, to remove the attacker's presence and close the vulnerability that allowed access.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company's incident response team is responding to a suspected insider threat. A privileged user has been observed accessing sensitive data outside of normal working hours. The team has not yet confirmed whether the activity is malicious. The user is a senior executive, and the company has a strict policy against monitoring executives without board approval. The incident commander must balance the need to investigate with legal and policy constraints. Which action should the incident commander take?

   • ASuspend the executive's access pending the investigation to prevent further data access.
   • BConfront the executive directly to ask about the activity and request an explanation.
   • CImmediately begin monitoring the executive's activities to gather evidence before it is destroyed.
   • DConsult with legal and the board to obtain approval for monitoring the executive's activities while continuing to gather non-privileged evidence.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company discovers that a former employee's credentials were used to access a system containing trade secrets. The IR team has confirmed the access but has not yet determined if data was exfiltrated. The company's legal counsel wants to know if they should notify law enforcement. What is the MOST appropriate guidance?

   • ANotify law enforcement only if the data exfiltration is confirmed.
   • BNotify law enforcement if the company suspects criminal activity, such as theft of trade secrets, and wants to pursue legal action.
   • CDo not notify law enforcement because the incident is an internal matter.
   • DNotify law enforcement only if the company has cyber insurance that requires it.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company's security team is triaging three simultaneous alerts: (1) a phishing email that was reported by a user and not clicked, (2) a single workstation with confirmed malware that is isolated, and (3) a server that is actively communicating with a known command-and-control server and exfiltrating data. Which alert should the team prioritize?

   • AThe phishing email because it could affect many users if they click the link.
   • BThe server communicating with the command-and-control server because it indicates active data exfiltration and high impact.
   • CAll three alerts equally because they all require attention.
   • DThe isolated workstation with confirmed malware because it is confirmed and needs eradication.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   After a significant incident, the IR team is conducting a lessons-learned meeting. The team lead wants to ensure that the meeting produces actionable improvements. Which approach is MOST effective?

   • AReview the incident timeline and identify specific process gaps, then assign owners and deadlines for each gap.
   • BCreate a detailed report of the incident and file it for future reference.
   • CDiscuss the incident only with the core IR team to keep the details confidential.
   • DFocus on what the team did well to build morale and avoid assigning blame.
   Reveal Solution Discussion Select an answer first