7.6 - Conduct Incident Management CISSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a key element of incident reporting procedures?

   • AWaiting until the incident is fully resolved before reporting
   • BDeleting all logs to protect privacy
   • CDocumenting the incident timeline and actions taken
   • DKeeping incident details confidential from all parties
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When a user's account is compromised, which mitigation action should be taken to prevent further unauthorized access?

   • AIncrease the account's permissions
   • BMonitor the account's activity
   • CChange the account's password
   • DDisable the compromised account
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   After a malware incident, the incident response team has contained the threat and eradicated the malware. The team is now planning to restore the affected systems. The organization has a recovery time objective (RTO) of 4 hours. The team has clean backups, but restoring all systems will take 6 hours. What is the BEST course of action?

   • ARestore the most critical systems first to meet the RTO for those systems, and restore the rest afterward.
   • BRestore the systems from the backups and then apply security patches.
   • CRestore all systems simultaneously to minimize the total restoration time.
   • DExtend the RTO to 6 hours to accommodate the restoration time.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary goal of the incident recovery phase?

   • AContain the incident to prevent further damage
   • BRestore affected systems and operations to normal functioning
   • CIdentify the root cause of the incident
   • DDocument lessons learned
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A user reports that they received a suspicious email with an attachment that they did not open. The email appears to come from a colleague but the sender address is slightly different. What is the BEST way to handle this report?

   • ATreat it as a potential security incident and investigate the email and its source.
   • BTell the user to delete the email and not worry about it.
   • CBlock the sender address in the email system immediately.
   • DForward the email to all employees as a warning.
   Reveal Solution Discussion Select an answer first