Incident Response and Business Continuity GSLC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During a security incident, the incident commander is coordinating the response. Which responsibility is MOST appropriate for the lead investigator?

   • ADeciding whether to shut down affected systems.
   • BConducting the technical investigation to determine the root cause and scope of the incident.
   • CApproving all public statements about the incident.
   • DContacting law enforcement and regulatory bodies.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of maintaining a chain of custody for digital evidence?

   • ATo speed up the forensic analysis process
   • BTo reduce the storage space required for evidence
   • CTo ensure the evidence is admissible in legal proceedings
   • DTo encrypt the evidence to prevent unauthorized access
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is performing a business impact analysis (BIA) to identify critical functions and quantify the impact of disruptions. The BIA team has identified that the payroll system is a critical function. Which metric is MOST relevant for quantifying the impact of a disruption to the payroll system?

   • AThe number of employees who use the payroll system.
   • BThe age of the payroll system.
   • CThe cost of the payroll software license.
   • DThe maximum tolerable downtime (MTD) for the payroll system.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A business continuity manager is deciding between a tabletop exercise and a full-scale simulation to test the continuity plan. The organization has never tested the plan and has limited budget. Which approach is the BEST choice?

   • AConduct a full-scale simulation immediately to get the most realistic results.
   • BSkip testing and rely on the plan's documentation.
   • CConduct a full-scale simulation only for the IT department.
   • DConduct a tabletop exercise first to identify gaps and then plan a full-scale simulation later.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization is developing its incident response and business continuity plans. Which approach BEST integrates these two processes to ensure organizational resilience?

   • ADevelop the business continuity plan first and then create the incident response plan based on it.
   • BEnsure the incident response plan includes triggers for activating the business continuity plan when an incident impacts critical business functions.
   • CKeep the two plans completely separate to avoid confusion during a crisis.
   • DUse the same team for both incident response and business continuity without defined roles.
   Reveal Solution Discussion Select an answer first