Incident Response and Post Incident Analysis CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which activity is a key part of the lessons learned process to improve incident handling?

   • AImmediately moving on to the next task without discussion
   • BKeeping the incident details confidential to avoid reputational damage
   • CConducting a post-incident review meeting with all involved parties
   • DDeleting all incident-related logs to free up storage
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security tester is part of a root cause analysis team investigating a ransomware attack. The team has determined that the initial infection occurred through a phishing email. The team is now trying to identify why the phishing email was not blocked by the email gateway. Which approach would be most effective?

   • AIncrease the spam filtering level on the email gateway.
   • BTrain employees to recognize phishing emails.
   • CBlock all incoming emails from external domains.
   • DReview the email gateway logs and configuration to identify the gap in filtering rules.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   After a ransomware incident, the incident response team successfully restored systems from backups. The post-incident review reveals that the initial detection was delayed because the security monitoring team did not recognize the early warning signs. The security tester is asked to recommend improvements. Which recommendation would be most effective in preventing a similar delay?

   • AImplement a security information and event management (SIEM) system with rules to detect ransomware behavior.
   • BReplace the security monitoring team with automated tools.
   • CIncrease the frequency of full system backups to reduce data loss.
   • DDisconnect all systems from the internet to prevent future attacks.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security tester is part of a root cause analysis team investigating a data exfiltration incident. The team has identified that the attacker used a phishing email to obtain credentials. The team is now trying to determine why the phishing email bypassed the email security controls. Which approach would be most effective?

   • AIncrease the frequency of security awareness training for all employees.
   • BBlock the sender's email address and domain.
   • CDisable email forwarding to prevent future data exfiltration.
   • DAnalyze the email headers and the security controls' configuration to identify the gap.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a security test, a tester identifies a critical vulnerability in a web application that could allow unauthorized data access. The tester reports it to the incident response team. What is the tester's primary role during the triage phase?

   • AProvide detailed technical information about the vulnerability to help the team assess its impact and urgency.
   • BWait for the incident response team to ask for more information before providing details.
   • CDelete all logs related to the vulnerability to protect the organization's reputation.
   • DImmediately patch the vulnerability to prevent exploitation.
   Reveal Solution Discussion Select an answer first