4.3 Establish and Maintain Incident Management Program ISSMP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which incident response methodology is known for its '6-step' process: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned?

   • AOWASP
   • BSANS
   • CISO 27035
   • DNIST SP 800-61
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a primary goal of the evidence collection phase in an investigation?

   • ATo restore systems to normal operation as quickly as possible
   • BTo share evidence with all employees to raise awareness
   • CTo preserve the integrity of the evidence
   • DTo quickly delete any malicious files to prevent further damage
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After a phishing incident that compromised several email accounts, the incident response team needs to report the impact to senior management. The report should help management understand the severity and decide on further investment. What is the most effective way to present the impact?

   • AQuantify the number of affected accounts, data exposure, and estimated financial loss, and present it in a clear dashboard.
   • BState that the incident was contained and no further action is needed.
   • CProvide a technical log of all email transactions during the incident.
   • DList the names of all employees whose accounts were compromised.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company's incident response team is handling a malware infection on a critical server. The team has contained the infection by isolating the server. The next step is to remove the malware and restore the server to normal operation. Which action should be taken next?

   • AImmediately reconnect the server to the network to resume operations.
   • BConduct a lessons-learned review before eradicating the malware.
   • CDelete all files on the server and reinstall the operating system without preserving evidence.
   • DEradicate the malware by cleaning the system and applying patches, then recover from a known-good backup.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team is establishing a case management process for incident response. The team wants to ensure that each incident has a clear owner, a status, and a record of all actions taken. Which element is most essential for this process?

   • AA shared spreadsheet that anyone can edit without restrictions.
   • BA policy that states all incidents must be resolved within 24 hours.
   • CA defined workflow that includes assignment, status updates, and closure criteria.
   • DA list of all security tools used by the team.
   Reveal Solution Discussion Select an answer first