Preparing for Incident Response GSOM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How are incident response team roles typically assigned?

   • ARandomly assigned at the start of each incident
   • BBased on seniority alone, regardless of technical expertise
   • CAssigned only to external consultants
   • DBased on the individual's job function, skills, and availability during an incident
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary role of an incident response policy within an organization?

   • ATo replace the need for incident response training by providing step-by-step instructions
   • BTo list the exact commands to run when a specific malware is detected
   • CTo provide a high-level mandate that establishes the authority and expectations for incident response activities
   • DTo serve as a legal contract between the organization and its customers
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is it important to regularly test and validate an incident response plan?

   • ATo ensure the plan remains effective and current with the evolving threat landscape and organizational changes
   • BTo replace the need for continuous monitoring and threat intelligence
   • CTo prove that the organization is immune to cyber attacks
   • DTo satisfy the requirement that all plans be tested at least once a year
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security operations manager is planning an incident response training program for a global company with employees in different time zones. The team includes both technical and non-technical staff. The training must be effective for all roles and accommodate different schedules. Which approach best meets these requirements?

   • ARequire all employees to attend a week-long in-person training at a central location
   • BSend a recorded video of a training session to all employees
   • CConduct a single live training session at the company headquarters during business hours
   • DProvide on-demand, role-based training modules that employees can complete at their own pace, supplemented by live virtual exercises for the incident response team
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a tabletop exercise, the incident response team discovers that they cannot access the forensic imaging tool because the license is tied to a single workstation that is currently offline. Which preparation step would have prevented this issue?

   • ACreating a detailed incident response plan with clear roles
   • BConducting a post-incident review after the exercise
   • CScheduling annual refresher training for the team
   • DMaintaining a validated inventory of tools with redundant licenses and access methods
   Reveal Solution Discussion Select an answer first