4.3 Establish and Maintain Incident Management Program ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company experienced a data breach that exposed customer personal information. The incident response team must report the impact to the data protection officer (DPO) and legal counsel. The report should support regulatory notification decisions. Which information is most critical to include?

   • AThe IP addresses of the attacker and the malware used.
   • BThe names of the security team members who responded.
   • CThe cost of the incident response tools used.
   • DThe types of data exposed, the number of affected individuals, and the duration of the exposure.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   During a forensic investigation, the security team collects a hard drive image from a compromised server. The team needs to analyze the image without altering the original evidence. Which approach is most appropriate?

   • AUse the original image for analysis and then delete it after the investigation.
   • BAnalyze the original hard drive directly to avoid copying errors.
   • CMake a copy of the image but do not verify hashes to save time.
   • DWork on a copy of the image and verify the hash of the original image to ensure integrity.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   During an investigation of a suspected insider threat, the legal department requests that the investigation be kept confidential. The security team needs to collect evidence from an employee's workstation. The employee is still working and has not been notified. Which action best balances legal requirements and evidence preservation?

   • AConduct a covert forensic image of the workstation's hard drive while the employee is away.
   • BWait until the employee leaves the company to collect evidence.
   • CMonitor the employee's activity without collecting any data.
   • DConfront the employee and ask them to hand over the workstation.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A mid-sized financial firm is establishing an incident response team. The CISO wants to ensure that during a major incident, there is a clear decision-maker, a person who coordinates communication, and technical experts who perform containment. The team will follow NIST SP 800-61. Which structure best meets these requirements?

   • AAllow all team members to make decisions collectively to ensure consensus.
   • BOutsource all incident response to an external vendor with no internal roles defined.
   • CDefine a central incident commander, a communications lead, and technical responders with clearly assigned roles.
   • DAssign the most senior technical person to handle both decision-making and technical containment.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A manufacturing company's security team responds to a ransomware incident. During the response, the team lead assigns each responder a specific task, but there is no central record of who performed which action, what was discovered, or when the actions occurred. After containment, the legal department requests a chronological account of all response activities to support potential litigation. Which action best addresses the gap?

   • AReconstruct the timeline after the fact by interviewing each responder.
   • BWait until the incident is closed, then write a summary report for legal.
   • CStore all raw logs in a shared folder without additional documentation.
   • DCreate a formal incident case file that logs all actions, findings, timestamps, and decisions as they occur.
   Reveal Solution Discussion Select an answer first