4.3 Establish and Maintain Incident Management Program ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When establishing an incident response team, which of the following is a critical staffing consideration?

   • AHiring only external contractors to avoid internal bias
   • BLimiting the team to a single person to reduce communication overhead
   • CEnsuring that all team members have the same skill set
   • DDefining clear roles and responsibilities for each team member
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A global company is establishing an incident response team that must operate 24/7 across different time zones. The team needs to ensure that at any time there is a designated person who can make decisions and coordinate response. Which staffing model is most appropriate?

   • AImplement a follow-the-sun model with regional teams and a clear on-call rotation for incident commanders.
   • BRely on a single team in one time zone to handle all incidents.
   • CHave all team members on call 24/7 without a designated leader.
   • DOutsource all incident response to a vendor without internal coordination.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of an incident response case management system?

   • ATo replace the need for an incident response team
   • BTo provide real-time threat intelligence feeds
   • CTo automatically contain and eradicate threats without human intervention
   • DTo track, manage, and document incidents from detection to closure
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst detects a series of failed login attempts followed by a successful login from an unusual location. The analyst wants to follow a structured methodology to handle this potential incident. Which approach aligns with NIST SP 800-61?

   • AImmediately disconnect the affected system and then conduct a full forensic analysis.
   • BWait for additional failed attempts before taking any action.
   • CChange the user's password and close the incident without further investigation.
   • DPerform preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   After a security incident, the root cause analysis team identifies that a vulnerability was present because the organization did not have a formal patch management process. The team must recommend a preventive measure. Which recommendation is most aligned with root cause analysis?

   • APurchase additional security tools to detect unpatched systems.
   • BEstablish a formal patch management policy and procedure with defined SLAs for critical patches.
   • CTrain IT staff on the importance of patching.
   • DIncrease the frequency of vulnerability scans.
   Reveal Solution Discussion Select an answer first