Managing Incident Response Execution GSOM Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A security operations manager receives simultaneous alerts: a single workstation with a confirmed ransomware infection that is isolated from the network, and a second alert indicating a phishing email was opened by 200 users with credentials potentially compromised. The SOC has limited staff. Which incident should be prioritized for immediate response?

   • ABoth incidents equally, because all incidents require the same level of immediate attention
   • BThe workstation ransomware, because it is confirmed and requires immediate eradication
   • CThe workstation ransomware, because confirmed incidents always take precedence over unconfirmed ones
   • DThe phishing incident, because it affects a large number of users and has high potential impact
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   After a ransomware incident is resolved, the incident commander schedules a post-incident review. What is the PRIMARY goal of this review?

   • ARestore all systems to their pre-incident state
   • BDelete all evidence related to the incident to reduce legal exposure
   • CAssign blame to the team members who made mistakes during the response
   • DIdentify gaps in the response process and implement improvements
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   After a significant incident, the incident response team conducts a post-incident review. The team identifies several areas for improvement, including a lack of clear escalation paths and insufficient training for new team members. The security operations manager needs to prioritize the improvements. Which improvement should be prioritized first?

   • AIncrease the number of security analysts on the team to handle future incidents.
   • BSchedule training for all team members on the new SIEM tool.
   • CImplement a new security information and event management (SIEM) tool to improve detection.
   • DRevise the incident response plan to include clear escalation paths and roles.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which sequence correctly represents the incident response lifecycle phases as commonly defined in the NIST SP 800-61 framework?

   • ADetection, Containment, Eradication, Recovery, Preparation, Lessons Learned
   • BPreparation, Eradication, Containment, Detection, Recovery, Post-Incident Activity
   • CDetection, Preparation, Eradication, Containment, Recovery, Lessons Learned
   • DPreparation, Detection and Analysis, Containment, Eradication, Recovery, Post-Incident Activity
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   During a large-scale incident, the incident commander is overwhelmed with coordinating multiple workstreams and communicating with executives. The team needs to improve efficiency. Which action should the incident commander take?

   • APause the incident response until the team can be reorganized.
   • BContinue to handle all communications personally to ensure accuracy.
   • CAsk the lead analyst to also handle executive communications.
   • DDelegate the technical analysis to the lead analyst and the executive communications to the communications lead.
   Reveal Solution Discussion Select an answer first