Preparing for Incident Response GSOM Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   After a tabletop exercise, the incident response team identifies that the communication plan is unclear, and several members are unsure who to contact first. What is the most effective next step to address this finding?

   • AHold a meeting to discuss the communication plan without updating the documentation
   • BIgnore the finding because tabletop exercises are not realistic
   • CSend an email to the team with the updated contact list
   • DUpdate the incident response plan to include a clear call tree and validate it with a follow-up exercise
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security operations manager is updating the incident response policy to align with new regulatory requirements. The policy currently states that all incidents must be reported to the data protection authority within 72 hours. Which additional element is most important to include in the policy to support this requirement?

   • AA schedule for annual penetration testing
   • BA template for press releases about security incidents
   • CA list of approved vendors for forensic analysis
   • DA definition of what constitutes a reportable incident and the process for making the notification
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An organization has just completed writing its incident response plan. The security manager wants to validate that the plan works in practice and that team members understand their roles. Which testing method would best achieve this with minimal disruption to normal operations?

   • ARun a full-scale simulation that includes shutting down a production server
   • BReview the plan documentation for spelling and formatting errors
   • CConduct a tabletop exercise where participants walk through a simulated incident scenario
   • DDistribute the plan to all employees and ask them to read it
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security operations manager is developing an incident response plan for a company that operates a 24/7 e-commerce platform. The plan must minimize downtime during a cyber incident while ensuring that forensic evidence is preserved. The company has a limited budget and cannot afford redundant forensic tools. Which approach best balances these constraints?

   • AFocus exclusively on forensic collection before any containment action
   • BImmediately rebuild all affected systems from backup without any forensic collection
   • CPrioritize rapid containment and recovery, and perform forensic collection in parallel where feasible
   • DDelay all response actions until law enforcement arrives
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security operations manager is preparing the incident response toolset. The team must be able to collect forensic evidence from remote endpoints, but the budget is limited. The manager must choose between a commercial tool with a high license cost and an open-source tool that requires more manual effort. Which approach best balances cost and capability?

   • AUse the open-source tool without any training
   • BPurchase the commercial tool despite the high cost
   • CDelay the decision until an incident occurs
   • DAdopt the open-source tool and invest in training to maximize its effective use
   Reveal Solution Discussion Select an answer first