7.6 - Conduct Incident Management CISSP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security incident is detected on a critical database server. The server is part of a cluster that provides a service to external customers. The incident response team suspects that the server is compromised. The team wants to contain the incident while minimizing service disruption. What is the BEST approach?

   • AFail over the service to a redundant server and isolate the compromised server for investigation.
   • BDisconnect the compromised server from the network but keep it running for forensic analysis.
   • CPatch the vulnerability on the compromised server while it is still in production.
   • DShut down the compromised server immediately to prevent further damage.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company has experienced a data breach that involves the personal data of customers. The incident response team has contained the breach and is preparing to notify affected customers. The legal team advises that the breach notification should be sent as soon as possible. What is the MOST important consideration when drafting the notification?

   • AMinimize the details to avoid alarming customers.
   • BNotify the media before notifying the customers to ensure public awareness.
   • CInclude a clear description of the incident, the data involved, and the steps customers can take to protect themselves.
   • DDelay the notification until all forensic analysis is complete to provide a full account.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which action is an example of incident remediation?

   • AIsolating the infected system from the network
   • BApplying a security patch to fix the vulnerability that was exploited
   • CRestoring data from backup
   • DSending an incident report to management
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a primary method for detecting security incidents through automated analysis of network traffic and system logs?

   • AIntrusion detection system (IDS)
   • BConfiguration management database (CMDB)
   • CPatch management tool
   • DVulnerability scanner
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company's network is segmented into multiple VLANs. During an incident, malware is detected on a server in the finance VLAN. The incident response team wants to prevent the malware from spreading to other VLANs. Which action is MOST effective?

   • AShut down the entire network to stop all communication.
   • BIsolate the finance VLAN by blocking traffic between it and other VLANs at the firewall.
   • CChange the IP address of the affected server.
   • DDisable the switch ports of all devices in the finance VLAN.
   Reveal Solution Discussion Select an answer first