Preparing for Incident Response GSOM Practice Questions (Page 11)

Questions 51–54

1. 51foundation · easy

   Which method of testing an incident response plan involves a simulated incident that is played out in a controlled, discussion-based environment?

   • AFull-scale live exercise
   • BTabletop exercise
   • CCode review
   • DPenetration test
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A security operations manager is preparing to coordinate with law enforcement for potential cybercrime incidents. The legal team has advised that evidence must be preserved according to strict chain-of-custody rules. However, the incident response team uses a cloud-based ticketing system that stores data in a foreign country. What is the most appropriate action?

   • AStop using the ticketing system and document all evidence manually
   • BIgnore the issue because law enforcement will not check the ticketing system
   • CAsk law enforcement to provide their own evidence management system
   • DEnsure that the ticketing system is configured to store evidence data in a jurisdiction that meets chain-of-custody requirements
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   During a data breach, the incident response team discovers that the breach involves personal data of customers in multiple countries. The legal advisor states that different jurisdictions have different notification requirements. The team is under pressure to notify regulators quickly. What is the most appropriate action?

   • ANotify only the regulator in the company's home country
   • BPrioritize notifications based on the legal requirements and deadlines of each jurisdiction
   • CNotify all regulators in all jurisdictions simultaneously to ensure compliance
   • DWait until the full investigation is complete before notifying any regulator
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A security manager is updating the incident response policy. The policy must define the circumstances under which the organization will involve law enforcement. The manager must balance the need for legal action with the risk of damaging the company's reputation. Which policy element is most appropriate?

   • ALeave the decision to the discretion of the incident commander without any criteria
   • BProhibit law enforcement involvement in all cases
   • CDefine specific criteria for law enforcement involvement, such as the type and severity of the incident
   • DRequire law enforcement involvement for every incident
   Reveal Solution Discussion Select an answer first