Managing Incident Response Execution GSOM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which action is part of the eradication phase of incident response?

   • ADisconnecting affected systems from the network
   • BDeleting malware from affected systems
   • CRestoring data from backups
   • DConducting a lessons-learned meeting
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company experiences a data breach involving personal data of EU residents. The incident response team is preparing to notify affected individuals. Which requirement must the team consider?

   • AThe notification to affected individuals must be made without undue delay after the breach is discovered.
   • BThe notification must be made within 72 hours of the company becoming aware of the breach.
   • CThe notification must be made in the language of the country where the company is headquartered.
   • DThe notification must be made only if the breach involves more than 500 individuals.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations manager wants to evaluate the effectiveness of the incident response team. Which metric would BEST indicate how quickly the team can contain an incident?

   • ATime to detect (TTD)
   • BTime to recover (TTR)
   • CTime to respond (TTR)
   • DTime to contain (TTC)
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company discovers that a cybercriminal has stolen customer personal data from its database. The company's legal counsel advises that the breach may trigger a state data breach notification law. Which action should the incident response team take regarding law enforcement?

   • AContact law enforcement immediately before conducting any internal investigation.
   • BCoordinate with legal counsel to determine the appropriate timing and method for notifying law enforcement.
   • CAvoid involving law enforcement to prevent the incident from becoming public.
   • DNotify law enforcement only after the incident is fully contained and eradicated.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company discovers a breach involving personal data of EU residents. The incident response team is preparing to notify affected individuals. What legal requirement must they consider FIRST?

   • AThe requirement to publish the breach on the company's public website
   • BThe GDPR requirement to notify the supervisory authority within 72 hours of becoming aware of the breach
   • CThe requirement to notify law enforcement before any internal investigation
   • DThe requirement to notify all affected individuals within 24 hours
   Reveal Solution Discussion Select an answer first