Incident Response and Business Continuity GSLC Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A security operations center (SOC) receives three alerts simultaneously. Alert 1: A single workstation has been infected with adware. Alert 2: A database server is being accessed by an unauthorized user from an external IP address. Alert 3: A phishing email has been reported by one user. Which alert should be handled FIRST?

   • AHandle all three alerts simultaneously, as they are all equally important.
   • BAlert 2, because it involves unauthorized access to a critical system and has the highest potential impact.
   • CAlert 1, because adware can spread quickly and infect other workstations.
   • DAlert 3, because phishing emails are a common entry point for more serious attacks.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company has suffered a data breach, and the incident response team has collected digital evidence from the affected systems. The evidence is critical for a potential legal case against the attacker. The company's legal counsel has requested that the evidence be handed over to law enforcement. Which action is MOST appropriate to ensure the evidence remains admissible in court?

   • ADocument the chain of custody for the evidence, including who collected it, when, and where it has been stored.
   • BCopy the evidence to a USB drive and hand it to law enforcement without any documentation.
   • CKeep the evidence in a secure location and refuse to hand it over to law enforcement.
   • DDelete the evidence after handing it over to law enforcement to protect the company's privacy.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company is updating its incident response and business continuity plans. The incident response plan focuses on containing and eradicating a cyberattack, while the business continuity plan focuses on restoring critical business functions. Which integration point is MOST critical to ensure a coordinated response?

   • AEnsuring the incident response team and business continuity team use the same communication tools.
   • BDefining clear triggers for activating the business continuity plan based on incident severity and impact.
   • CCreating a single plan that covers both incident response and business continuity.
   • DHaving the incident response team also manage the business continuity plan.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a common classification used to categorize the severity of a security incident?

   • AType A, Type B, Type C
   • BLow, Medium, High
   • CRed, Green, Blue
   • DStage 1, Stage 2, Stage 3
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A business continuity plan has been developed and approved. What is the NEXT step to ensure the plan remains effective?

   • AWait for a real incident to see if the plan works.
   • BSchedule regular tests and exercises to validate the plan and identify gaps.
   • CDistribute the plan to all employees and consider the job complete.
   • DStore the plan in a secure location and only access it during an incident.
   Reveal Solution Discussion Select an answer first