Incident Response and Business Continuity GSLC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's security operations center (SOC) has detected a potential security incident. The SOC analyst has confirmed that the incident is real and has escalated it to the incident response team. Which action should the SOC analyst take NEXT?

   • ADelete all logs related to the incident to prevent the attacker from covering their tracks.
   • BDocument the incident details, including the time of detection, the systems affected, and the initial response actions taken.
   • CImmediately shut down all affected systems to prevent further damage.
   • DNotify the company's public relations team to prepare a press release.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a key output of a business impact analysis?

   • AA list of all security vulnerabilities
   • BThe organization's incident response plan
   • CRecovery time objectives (RTO) for critical functions
   • DA detailed network diagram
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is it important for incident response and business continuity plans to be aligned?

   • ATo reduce the need for security controls
   • BTo ensure that only one plan is used
   • CTo eliminate the need for testing
   • DTo ensure a coordinated and efficient response to disruptions
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the incident response lifecycle, which phase involves restoring affected systems to normal operation while ensuring the threat is fully removed?

   • AEradication
   • BContainment
   • CLessons Learned
   • DRecovery
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst detects a ransomware infection on a file server used by the finance department. The malware is actively encrypting files, and the analyst has confirmed the infection is spreading to other servers on the same network segment. The incident commander has been notified. Which action should be taken FIRST to limit the spread of the infection?

   • ADisconnect the affected file server and the other servers on the same network segment from the network.
   • BBegin a forensic image of the affected file server to preserve evidence for potential legal action.
   • CRun a full antivirus scan on the affected file server to identify and quarantine the ransomware binary.
   • DNotify the finance department that their files are encrypted and they should restore from backups.
   Reveal Solution Discussion Select an answer first