Preparing for Incident Response GSOM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations manager is preparing for potential incidents that may involve criminal activity. The organization wants to ensure that evidence is preserved in a way that supports potential legal action. Which action is most important to take during the preparation phase?

   • APurchase additional forensic software licenses
   • BSchedule regular backups of all servers
   • CCreate a public relations plan for media inquiries
   • DEstablish a relationship with law enforcement and document the process for evidence handling
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a key component of incident response preparation?

   • AGuaranteeing that all employees have the same level of technical expertise
   • BDeveloping and maintaining an incident response plan
   • CPurchasing the most expensive security tools available
   • DEnsuring that the incident response team works in isolation from other business units
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security manager is designing an incident response training program. The program must ensure that team members can effectively execute their roles during a high-pressure incident. The team has limited time for training. Which training method is most effective?

   • AConduct a single, lengthy training session covering all topics
   • BConduct regular, scenario-based drills that simulate realistic incident conditions
   • CProvide a comprehensive training manual and require self-study
   • DFocus training only on technical skills, not on decision-making
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During a ransomware incident, the incident response team needs to quickly determine which systems are affected and preserve evidence. The team includes a forensic analyst, a network engineer, and a legal advisor. Which additional role is most critical to add to the team to support this effort?

   • AA system administrator with access to critical servers and backups
   • BA human resources representative to manage employee communications
   • CA communications lead to manage internal and external messaging
   • DA marketing specialist to handle customer inquiries
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a key benefit of coordinating with external vendors (e.g., security tool providers) during incident response preparation?

   • AGuaranteeing that the vendor will provide free services during any incident
   • BEnsuring that support contracts and escalation procedures are in place for rapid assistance during an incident
   • CTransferring full responsibility for incident response to the vendor
   • DEliminating the need for internal incident response training
   Reveal Solution Discussion Select an answer first