2.3 - Understand Incident Response CC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a key reason why incident response is important for business continuity?

   • AIt provides a structured approach to restore operations quickly after a security incident
   • BIt eliminates the need for a disaster recovery plan
   • CIt ensures that all employees receive security awareness training annually
   • DIt guarantees that all security incidents are resolved within one hour
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a key step in developing an incident response plan?

   • AEstablishing procedures for detecting, containing, and recovering from incidents
   • BHiring external consultants to manage all incidents
   • CPurchasing new hardware for all employees
   • DDeleting all sensitive data to prevent breaches
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company's incident response team is responding to a worm that is spreading through the network. The team has identified the infected systems and wants to contain the worm. However, the business insists on keeping critical systems online to maintain operations. Which containment strategy best balances the need to stop the worm with the need to maintain business operations?

   • ALeave all systems online and monitor the worm's spread
   • BPower off all infected systems immediately
   • CSegment the network to isolate infected systems while allowing critical systems to continue operating
   • DDisconnect the entire network from the internet
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company experiences a ransomware attack. The incident response team quickly contains the attack, but the business decides to pay the ransom to recover data faster. The incident response team disagrees, citing the risk of not actually recovering data. Which consideration is most important in this decision?

   • AThe incident response plan should have predefined guidelines on ransom payment decisions
   • BThe incident response team should not be involved in the decision
   • CThe incident response team should always refuse to pay ransoms
   • DThe business should pay the ransom immediately to minimize downtime
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a key component of an incident response program?

   • AA financial audit schedule to review quarterly budgets
   • BA communication plan that defines how information is shared during an incident
   • CA marketing strategy to promote the organization's security posture
   • DA software development lifecycle for creating new applications
   Reveal Solution Discussion Select an answer first