Incident Response and Post Incident Analysis CT-STE Practice Questions (Page 7)

Questions 31–32

1. 31expert · hard

   After a data breach, the incident response team identifies that the attacker exploited a vulnerability in a custom web application. The team fixed the specific vulnerability, but the post-incident analysis is ongoing. The security tester is asked to recommend a root cause analysis approach. Which approach would best identify the underlying cause?

   • AConduct a '5 Whys' analysis to trace the vulnerability back to a missing security requirement in the development process.
   • BReplace the custom application with a commercial product to avoid similar issues.
   • CRe-run the penetration test to confirm the vulnerability is fixed.
   • DReview the web server logs to identify the attacker's IP address and block it.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   After a security incident, the post-incident review reveals that the incident response team lacked clear roles and responsibilities, causing delays in containment. The security tester is asked to recommend improvements. Which recommendation would be most effective?

   • AConduct a root cause analysis to identify the technical cause of the incident.
   • BIncrease the number of security staff on the incident response team.
   • CDevelop and regularly test an incident response plan with defined roles and responsibilities.
   • DPurchase more advanced security tools to automate incident response.
   Reveal Solution Discussion Select an answer first