Incident Response and Business Continuity GSLC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When a security incident is detected, who should be the first to receive the incident report?

   • AAll employees in the organization
   • BThe organization's customers
   • CThe incident response team
   • DThe public via press release
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In an incident response team, which role is primarily responsible for coordinating the overall response effort and making final decisions about strategy and priorities?

   • ACommunications Lead
   • BLegal Counsel
   • CLead Investigator
   • DIncident Commander
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of a business impact analysis (BIA)?

   • ATo determine the root cause of an incident
   • BTo identify critical business functions and quantify the impact of disruptions
   • CTo develop a list of all employees
   • DTo test the effectiveness of security controls
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How do incident response and business continuity processes integrate during a disruption?

   • AIncident response is only used after business continuity fails
   • BBusiness continuity replaces incident response during a disruption
   • CIncident response handles the immediate threat, while business continuity ensures critical operations continue
   • DThey are independent and do not interact
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst notices repeated failed logins to a legacy finance application from a single external IP, followed by a successful login using a service account with administrative privileges. The analyst immediately disables the account and blocks the IP. Which action should the analyst take NEXT to align with the incident response lifecycle?

   • ARestore the service account from backup and reset its password to minimize downtime.
   • BEscalate the event to the incident commander and document the detection and initial response actions.
   • CDelete the service account and create a new one with a different name.
   • DNotify the finance department and ask them to verify the account activity.
   Reveal Solution Discussion Select an answer first