7.6 - Conduct Incident Management CISSP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has experienced a series of phishing attacks that have resulted in the compromise of several user accounts. The incident response team has contained each incident and reset the compromised accounts. However, the attacks continue. What is the MOST effective way to remediate the root cause?

   • ABlock all external email messages to prevent phishing emails from reaching users.
   • BDeploy an email filtering solution to block phishing emails.
   • CIncrease the frequency of security awareness training for all employees.
   • DImplement multi-factor authentication (MFA) for all user accounts.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company discovers a data breach involving personal data of EU citizens. The incident response team has contained the breach and is now documenting the incident. Which of the following is the MOST important consideration when reporting to external authorities?

   • AReport the incident to the media to ensure public transparency.
   • BReport the incident within the legally required timeframe and provide the required information.
   • CInclude the full technical details of the attack vectors and vulnerabilities exploited.
   • DWait until the investigation is complete to provide a full and accurate report.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common step in restoring a system during incident recovery?

   • ADisabling the system permanently
   • BRestoring data from a known-good backup
   • CIgnoring the incident and moving on
   • DDeleting all user accounts
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   After a major security incident, the incident response team is conducting a lessons-learned review. The team has identified several areas for improvement, including the need for better detection tools and more frequent training. The management wants to ensure that the improvements are implemented. What is the BEST way to ensure that the lessons learned are acted upon?

   • ASchedule a follow-up meeting in six months to discuss the improvements.
   • BAdd the improvements to the incident response plan and consider them complete.
   • CDocument the improvements in the incident response report and share it with management.
   • DAssign each improvement to a specific owner with a deadline and track progress in a project management tool.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a security incident, the incident response team discovers that the attack originated from a specific external IP address. The team wants to share this information with other organizations to help them defend against similar attacks. What is the BEST way to share this information?

   • AWait until the incident is fully resolved before sharing any information.
   • BPublish the IP address and attack details on a public threat intelligence sharing platform.
   • CKeep the information confidential to avoid tipping off the attacker.
   • DReport the IP address to the media to warn the public.
   Reveal Solution Discussion Select an answer first