Execute the Incident Response Plan CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which activity is part of remediation verification?

   • ARunning vulnerability scans on restored systems
   • BIsolating the affected network segment
   • CDocumenting the incident timeline
   • DCreating a forensic image of affected systems
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which practice is essential for maintaining the chain of custody during evidence collection?

   • ADocumenting every person who handles the evidence
   • BUsing the original system for analysis
   • CStoring evidence on the affected system
   • DEncrypting all collected evidence
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which output is expected from a post-incident review?

   • AA forensic image of affected systems
   • BA list of recommended improvements to security controls
   • CA root cause analysis report
   • DA containment strategy for the incident
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of remediation verification?

   • ATo identify the attacker's identity
   • BTo collect additional forensic evidence
   • CTo update the incident response plan
   • DTo ensure that remediation measures are effective and systems are secure
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security incident occurred because an employee fell for a phishing email and entered their credentials on a fake login page. The incident response team wants to prevent recurrence. What is the most effective root cause analysis approach?

   • ADisable the employee's account and issue a warning.
   • BRequire all employees to change their passwords immediately.
   • CExamine the phishing email and the fake login page to identify the attack vector and the human factors involved.
   • DBlock the phishing email's sender address in the email gateway.
   Reveal Solution Discussion Select an answer first