Preparing for Incident Response GSOM Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security manager is planning incident response training for the team. The team includes both technical and non-technical members. What is the most effective training approach?

   • AProvide a one-time training session at hire
   • BProvide the same advanced technical training to all members
   • CProvide role-specific training that addresses each member's responsibilities in the incident response plan
   • DConduct training only for the technical members of the team
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security manager has conducted a tabletop exercise for the incident response team. The exercise revealed that the team is unfamiliar with the new incident response plan that was updated three months ago. The manager has a limited budget and must improve the team's familiarity with the plan. Which action is most effective?

   • AConduct a series of short, focused tabletop exercises that specifically walk through the updated sections of the plan
   • BConduct a full-scale simulation immediately
   • CDistribute the updated plan via email and require a read receipt
   • DPost the updated plan on the internal wiki and move on
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How do incident response procedures support the execution of an incident response plan?

   • AThey define the overall mission and objectives of the incident response program
   • BThey specify the budget and funding for incident response tools
   • CThey list the names and contact information of all employees in the organization
   • DThey provide detailed, step-by-step actions to be taken during an incident
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security manager is reviewing the incident response policy. The policy states that all incidents must be reported to the incident commander within 15 minutes of detection. Why is this policy element important?

   • AIt ensures that law enforcement is automatically notified
   • BIt guarantees that the incident will be contained within 15 minutes
   • CIt ensures timely escalation so that the incident commander can make informed decisions
   • DIt eliminates the need for further investigation
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is it important to establish relationships with law enforcement before an incident occurs?

   • ATo avoid the need for internal incident response capabilities
   • BTo ensure a faster and more coordinated response when law enforcement involvement is needed
   • CTo guarantee that law enforcement will handle all incidents without organizational effort
   • DTo ensure that all incidents are reported to the media
   Reveal Solution Discussion Select an answer first