Preparing for Incident Response GSOM Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security operations manager is preparing for incident response and wants to ensure that the organization can quickly obtain specialized forensic assistance during a major breach. Which action is most effective during the preparation phase?

   • ATrain internal staff on basic forensic techniques
   • BEstablish pre-negotiated contracts with a digital forensics vendor
   • CPurchase additional forensic software licenses
   • DDocument the incident response plan in a shared folder
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security operations manager is preparing for incident response and must decide how to coordinate with external entities. The company is subject to data protection regulations that require prompt notification of a breach. The manager must balance the need for timely notification with the risk of premature disclosure. Which approach is most appropriate?

   • AEstablish pre-defined notification criteria and a designated point of contact for each external entity
   • BDelay notification until the investigation is complete
   • CDelegate all external communication to the legal department without predefined criteria
   • DNotify all external entities immediately upon any suspected incident
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security operations manager wants to improve the incident response team's ability to work together during a crisis. The team has never performed a coordinated exercise. Which training activity would be most effective to build teamwork and test the plan?

   • AConduct a tabletop exercise with all team members to walk through a realistic scenario
   • BDistribute a copy of the incident response plan to each team member
   • CSend team members to a security conference
   • DProvide each team member with a self-paced online course on incident response
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security operations manager is developing an incident response plan for a company that relies heavily on legacy systems that cannot be patched immediately. The plan must balance the need to contain incidents quickly with the risk of disrupting business operations. Which strategy is most effective?

   • ARequire immediate shutdown of all legacy systems during any incident
   • BExclude legacy systems from the incident response plan because they are not supported
   • CRely solely on the vendor's support for legacy systems
   • DDevelop a containment strategy that includes compensating controls, such as network segmentation and enhanced monitoring, for legacy systems
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary goal of incident response preparation within a security operations context?

   • ATo ensure the organization is ready to detect, respond to, and recover from security incidents in a timely and effective manner
   • BTo replace the need for continuous security monitoring by having a response plan in place
   • CTo guarantee that all incidents are resolved without any impact to business operations
   • DTo eliminate the possibility of any security incident occurring
   Reveal Solution Discussion Select an answer first