Preparing for Incident Response GSOM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security manager is designing an awareness program to reduce the time it takes for employees to report potential security incidents. Which approach is most likely to achieve this goal?

   • APublish a detailed technical guide on malware analysis for all employees
   • BProvide a simple, well-publicized reporting channel and train employees on what to report
   • CRequire employees to verify the incident with their supervisor before reporting
   • DConduct an annual security briefing that covers the full incident response plan
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations team is preparing to respond to incidents that may require forensic analysis of compromised workstations. The team currently has a limited budget and needs to ensure they can acquire and preserve evidence effectively. Which resource is most essential to have available before an incident occurs?

   • AA backup tape library for long-term storage
   • BA dedicated phone line for incident hotline calls
   • CA spare network switch for temporary network changes
   • DA forensic workstation with write-blockers and imaging software
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security operations manager is updating the incident response policy. The policy must clearly state that only the incident commander can authorize communication with external media. Why is this an important policy element?

   • AIt guarantees that no information is ever released to the public
   • BIt ensures that all incidents are reported to law enforcement
   • CIt allows the incident commander to bypass legal review
   • DIt prevents unauthorized information disclosure and ensures consistent messaging
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations manager is developing an incident response plan for a financial services company. The plan must include steps for containing a malware outbreak that could affect customer data. Which element is most important to include in the plan to ensure effective containment?

   • AA list of all employees' personal phone numbers
   • BA schedule for annual employee performance reviews
   • CPredefined isolation procedures for affected systems, including network segmentation and credential revocation
   • DA marketing plan for promoting the company's security posture
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security manager is assigning incident response team roles for a 24/7 security operations center. The team has a limited number of staff, and some staff are on call. The manager must ensure that the incident response plan can be executed at any time. Which approach is most effective?

   • ADefine primary and alternate role assignments with clear escalation paths
   • BDocument roles only in the incident response plan without assigning specific people
   • CAssign a single incident commander who is always on call
   • DRequire all team members to be available 24/7 without alternates
   Reveal Solution Discussion Select an answer first