Managing Incident Response Execution GSOM Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst discovers a suspected data breach involving customer personal information. The organization plans to involve law enforcement. What should the analyst do FIRST to preserve the integrity of evidence?

   • ARun antivirus scans on the affected systems to identify malware
   • BNotify the public relations team before any evidence collection
   • CCreate a forensic image of the affected systems using write-blocking tools
   • DCopy the affected files to a shared network drive for safekeeping
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a ransomware incident, the incident commander needs to assign a team member to handle communications with the company's legal counsel, public relations firm, and the FBI field office. Which role should be assigned this responsibility?

   • ACommunications lead, because they are responsible for managing information flow to stakeholders and external entities.
   • BLead analyst, because they have the most technical detail about the ransomware strain.
   • CIncident commander, because they have overall authority and can make decisions about external disclosures.
   • DScribe, because they are already documenting the incident and can provide accurate updates.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a major incident, the incident commander needs to provide updates to executives, legal counsel, and the IT team. What is the most effective communication approach?

   • AProvide tailored updates: high-level status to executives, legal implications to counsel, and technical details to IT
   • BOnly communicate with the IT team until the incident is resolved
   • CPost updates on the company's public website to keep everyone informed
   • DSend the same detailed technical report to all stakeholders
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is preparing to involve law enforcement in a data breach investigation. The incident response team has collected evidence from the compromised systems. The company's legal counsel is concerned about the admissibility of the evidence in court. Which action is most important to ensure the evidence is admissible?

   • AMake copies of the evidence and give the originals to law enforcement immediately.
   • BKeep the evidence in the incident response team's possession until the investigation is complete.
   • CEnsure that all evidence is collected using forensic tools and that the original media is preserved.
   • DDocument the chain of custody for all evidence, including who collected it, when, and where it has been stored.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   After a ransomware incident, the incident response team has contained the spread and eradicated the ransomware from the environment. The team is now planning the recovery of critical servers. The servers have been backed up, but the team is unsure whether the backups are clean. The business requires the servers to be restored as quickly as possible. Which recovery approach should the team take?

   • AReconnect the servers to the network and monitor them for a period before restoring data.
   • BRestore from a backup that predates the initial infection and verify the servers for signs of compromise before reconnecting.
   • CRebuild the servers from scratch using the original installation media and apply all patches, without using backups.
   • DRestore from the most recent backup and reconnect the servers to the network immediately to minimize downtime.
   Reveal Solution Discussion Select an answer first