6.2 Explain the Process and Outcomes of Incident Response CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which incident response phase involves removing the root cause of an incident from affected systems?

   • AEradication
   • BLessons Learned
   • CContainment
   • DDetection
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is investigating a potential insider threat. The analyst has identified that a user has been accessing sensitive files outside of normal business hours. The analyst must decide whether to confront the user or continue to monitor their activity. The organization's priority is to protect sensitive data while respecting employee privacy. Which action is most appropriate?

   • AConfront the user immediately to stop the potential data exfiltration.
   • BReport the user to HR without further investigation.
   • CDisable the user's account immediately to prevent further access.
   • DContinue to monitor the user's activity to gather more evidence before taking action.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization has just experienced a data breach. The incident response team has contained the breach and eradicated the threat. The CEO wants to know the business impact and what was done to prevent it from happening again. Which outcome of incident response directly addresses the CEO's request?

   • APost-incident analysis and reporting
   • BRecovery of affected systems
   • CEradication of the malware
   • DContainment of the threat
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which incident response outcome involves reviewing the incident to identify improvements for future response efforts?

   • AContainment
   • BEradication
   • CRecovery
   • DPost-incident analysis
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is part of an incident response team that has identified a malware infection on a server. The team has decided to isolate the server and is now planning the eradication phase. The team must decide whether to reimage the server or attempt to remove the malware manually. The server is a domain controller with critical services. Which approach is most appropriate?

   • AReimage the server and restore it from a known good backup.
   • BIsolate the server and continue to monitor it for any signs of reinfection.
   • CManually remove the malware using antivirus tools.
   • DRestore the server from the most recent backup without reimaging.
   Reveal Solution Discussion Select an answer first