7.6 - Conduct Incident Management CISSP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a ransomware incident, the incident response team has contained the spread and eradicated the malware. The organization is now ready to restore operations. Which of the following is the MOST critical step in the recovery process?

   • AReinstall the operating system on all affected servers from vendor media.
   • BConnect all systems to the network to resume normal operations quickly.
   • CRestore systems from the most recent clean backups and verify their integrity.
   • DNotify all employees that the incident is resolved and they can resume normal activities.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which technique is used to reduce the impact of a malware outbreak by preventing it from spreading to other network segments?

   • AUser awareness training
   • BData encryption
   • CLog aggregation
   • DNetwork segmentation
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an immediate action taken during incident response to limit the scope of an ongoing attack?

   • AUpdate the incident response plan
   • BPerform a root cause analysis
   • CRestore systems from backup
   • DIsolate affected systems from the network
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst notices that a user account has been locked out multiple times in a short period. The analyst suspects a brute-force attack. What is the BEST immediate action?

   • ADisable the account to prevent further brute-force attempts.
   • BReset the password of the account and inform the user.
   • CIgnore the lockouts because they are likely due to user error.
   • DIncrease the account lockout threshold to reduce user frustration.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After a significant security incident, the incident response team is conducting a post-incident review. What is the PRIMARY purpose of this review?

   • ATo identify what went wrong and what went right during the incident response.
   • BTo update the incident response plan with new contact information.
   • CTo document the incident for insurance claims.
   • DTo assign blame to individuals or teams for the incident.
   Reveal Solution Discussion Select an answer first