Execute the Incident Response Plan CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which action is an example of containment in remediation planning?

   • AIsolating an infected system from the network
   • BRestoring data from backups
   • CAnalyzing memory dumps
   • DUpdating the incident response plan
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center receives multiple alerts: a phishing email reported by a user, a failed login attempt on a non-critical system, and a potential data exfiltration from a database containing customer records. The team has limited resources. Which incident should be prioritized first?

   • AThe potential data exfiltration from the customer database.
   • BThe failed login attempt on the non-critical system.
   • CThe phishing email reported by the user.
   • DAll three incidents simultaneously, since they are all security incidents.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A hospital's IT team detects a ransomware infection on a workstation in the radiology department. The workstation is connected to the hospital's network, which also hosts the patient records system. The hospital is currently experiencing a high volume of patients. The incident response team must decide how to respond. What is the most appropriate immediate action?

   • AImmediately restore the workstation from a backup without isolating it.
   • BIsolate the workstation from the network to prevent the ransomware from spreading to the patient records system.
   • CContinue operations and monitor the situation, since the infection is only on one workstation.
   • DShut down the entire network to ensure the ransomware does not spread.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of root cause analysis in incident response?

   • ATo identify the underlying causes of an incident to prevent recurrence
   • BTo restore systems to normal operation
   • CTo collect evidence for legal proceedings
   • DTo contain the incident and limit damage
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company experienced a ransomware attack that encrypted files on several file servers. The incident response team has contained the spread and is now planning remediation. The company has backups, but the backups are from the previous night. What should the remediation plan include?

   • APay the ransom to obtain the decryption keys.
   • BDisconnect the servers and leave them offline until the investigation is complete.
   • CRestore the affected servers from the backups and then verify the integrity of the restored data.
   • DReimage the servers from the vendor's original installation media.
   Reveal Solution Discussion Select an answer first