4.1 - Understand and Support Incident Response Lifecycle (e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO)) SSCP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After a significant security incident, the incident response team has completed eradication and recovery. The CISO wants to ensure that the organization learns from the incident and improves its security posture. Which activity is MOST aligned with this goal?

   • ARestore all systems from backups and verify data integrity.
   • BDelete all temporary files from the affected systems.
   • CDisconnect all affected systems from the network.
   • DConduct a lessons learned review and update the incident response plan.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has detected a ransomware infection on several file servers. The incident response team needs to stop the spread while preserving evidence for forensic analysis. Which containment strategy is MOST appropriate?

   • AIsolate the affected file servers from the network.
   • BImmediately shut down all affected servers.
   • CChange all user passwords in the organization.
   • DRebuild all affected systems from known-good images.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary goal of a containment strategy in incident response?

   • ATo limit the damage caused by an incident
   • BTo document the incident for legal purposes
   • CTo identify the root cause of the incident
   • DTo restore systems to normal operation
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst has confirmed a data breach involving customer personal information. The incident response team needs to inform the appropriate stakeholders. According to the NIST incident response lifecycle, which communication should occur FIRST?

   • ANotify all customers immediately via email.
   • BNotify the organization's legal counsel and the incident response team lead.
   • CIssue a press release to the public.
   • DPost details of the breach on the company's social media accounts.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst notices unusual outbound network traffic from a finance workstation to an external IP address at 3:00 AM. The workstation also shows a new scheduled task that runs a PowerShell script. According to the NIST incident response lifecycle, what should the analyst do FIRST?

   • ANotify the public relations team to prepare a press release.
   • BCollect additional evidence and analyze the alerts to confirm whether this is a true incident.
   • CErase the workstation's hard drive to remove any malware.
   • DDeclare the incident and immediately isolate the workstation from the network.
   Reveal Solution Discussion Select an answer first