Execute the Incident Response Plan CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which technique is commonly used for root cause analysis?

   • ANetwork segmentation
   • BChain of custody
   • CData encryption
   • DFive Whys
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During forensic analysis of a breach, an investigator examines log files and identifies that an attacker used a valid user account to access sensitive data. The logs show the login originated from an IP address in a foreign country, but the user's physical location was in the office at the same time. What does this evidence most likely indicate?

   • AThe logs are inaccurate and should be disregarded.
   • BThe user accessed the data from a remote location using a VPN.
   • CThe user's account credentials were compromised and used by an external attacker.
   • DThe user is innocent and the IP address is a false positive.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   After a significant security incident, the incident response team completes the technical remediation. The CISO requests a post-incident review. What is the primary purpose of this review?

   • ADetermine the financial cost of the incident for insurance claims.
   • BVerify that all malware has been removed from the systems.
   • CAssign blame to the individuals responsible for the incident.
   • DIdentify lessons learned and update the incident response plan.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   After remediating a web application vulnerability, the security team wants to verify that the fix is effective and that no new issues were introduced. Which action is most appropriate?

   • AAsk the developers if they think the fix is complete.
   • BMonitor the application logs for a week to see if the attack recurs.
   • CRun a vulnerability scanner against the application and review the results.
   • DReview the code changes and approve them for production.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the main objective of forensic analysis?

   • ATo collect evidence from affected systems
   • BTo reconstruct events and identify the attack vector
   • CTo restore systems to normal operation
   • DTo identify the attacker's identity
   Reveal Solution Discussion Select an answer first