2.3 - Understand Incident Response CC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of a lessons learned meeting after an incident?

   • ATo identify what went well and what can be improved
   • BTo assign blame for the incident
   • CTo celebrate the successful resolution of the incident
   • DTo delete all evidence related to the incident
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is building its incident response program. The team has defined roles, created procedures, and selected tools. However, during a recent tabletop exercise, employees were unsure who to contact and how to escalate issues. Which component of the incident response program is most likely missing or inadequate?

   • AIncident response policy
   • BBackup and recovery procedures
   • CForensic toolset
   • DCommunication plan
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   During which phase of incident response does the organization review what happened and identify improvements?

   • AContainment
   • BDetection and analysis
   • CLessons learned
   • DPreparation
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst notices unusual outbound traffic from a finance workstation to an external IP at 3:00 AM. The analyst isolates the workstation from the network but does not power it off. Which incident response phase is the analyst primarily executing, and why is preserving the system state important?

   • ARecovery, to restore the system to normal operation as quickly as possible
   • BPreparation, to update the incident response plan based on this new threat
   • CEradication, to remove the malware from the system immediately
   • DContainment, to prevent lateral movement while preserving volatile evidence for later analysis
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is documentation important in post-incident activities?

   • AIt eliminates the need for a lessons learned meeting
   • BIt provides a record of what happened and supports future analysis
   • CIt ensures that the incident is completely forgotten
   • DIt is required by all organizations regardless of industry
   Reveal Solution Discussion Select an answer first