Execute the Incident Response Plan CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   After a security incident, the incident response team conducts a post-incident review. They find that the incident response plan was not followed because the on-call analyst was not trained on the plan. The team must decide how to address this finding. Which action is most appropriate?

   • AReplace the on-call analyst who did not follow the plan.
   • BDocument the finding and move on, since the incident is resolved.
   • CProvide additional training to the on-call analysts and update the plan to include a training requirement.
   • DRevise the incident response plan to be simpler so that it is easier to follow.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   During forensic analysis of a breach, an investigator finds that the attacker used a legitimate administrator account to access the system. The account belongs to an employee who is on vacation. The investigator must determine if the account was compromised or if the employee is involved. What is the most appropriate next step?

   • AInterview the employee's coworkers to gather information.
   • BAssume the employee is involved and escalate to law enforcement.
   • CCorrelate the account's activity with the employee's physical location and other authentication factors.
   • DImmediately disable the administrator account.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company detects a ransomware outbreak on a single file server. The incident response team is activated. The server hosts non-critical archived reports, but it is also connected to a network segment that contains the production database. The team must decide the immediate priority. What should the first action be?

   • ADisconnect the file server from the network to contain the spread.
   • BNotify law enforcement before taking any action.
   • CRebuild the file server from a known-good backup immediately.
   • DRun a full antivirus scan on the file server to remove the ransomware.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's web application was defaced, and the incident response team has identified a vulnerability in the content management system as the entry point. The team needs to remediate the incident while minimizing business disruption. Which action should be part of the remediation plan?

   • AApply the vendor's security patch to the content management system.
   • BIncrease the web server's logging level and monitor for further attacks.
   • CRestore the website from a backup and leave the system unpatched to avoid downtime.
   • DChange the administrator password and continue operations.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company's e-commerce website was compromised, and the attackers defaced the site and stole customer data. The incident response team has contained the breach and identified the vulnerability. The company must remediate the incident while minimizing revenue loss. Which remediation strategy is most appropriate?

   • APut the website back online immediately to resume sales, and patch the vulnerability later.
   • BRestore the website from a backup and monitor for further attacks without patching.
   • CKeep the website offline until the investigation is complete, even if it takes weeks.
   • DApply the security patch to the vulnerability, restore the website from a clean backup, and verify the fix before putting the site back online.
   Reveal Solution Discussion Select an answer first