6.2 Explain the Process and Outcomes of Incident Response CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst detects a zero-day exploit on a critical database server. The exploit is actively spreading to other servers. The analyst must choose between immediately isolating the server (which will disrupt business operations) or allowing it to continue running while gathering more evidence. The organization's priority is to minimize data loss while maintaining business continuity. Which action best balances these competing priorities?

   • AAllow the server to continue running to gather more evidence, then isolate it after analysis.
   • BIsolate the server immediately to stop the spread, then gather evidence from network logs and memory images.
   • CIsolate the server and immediately reimage it from a known good backup.
   • DTake a memory image first, then isolate the server.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization is updating its incident response plan. The team wants to ensure that all employees know how to report a suspected security incident and that the SOC has the necessary tools to detect and analyze incidents. Which phase of the incident response process is the organization focusing on?

   • ADetection and analysis
   • BPreparation
   • CLessons learned
   • DContainment
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a ransomware outbreak, the incident response team has successfully contained the affected systems and eradicated the malware from the environment. The organization's priority is to resume normal operations as quickly as possible while ensuring that the threat does not return. Which step should be taken next?

   • ARestore systems from the last known good backup and verify they are clean before reconnecting.
   • BIncrease firewall logging to monitor for any signs of reinfection.
   • CReimage all affected systems with the standard corporate image.
   • DConduct a lessons-learned meeting to document what went wrong.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During a security incident, the incident response team has identified the root cause: a phishing email led to credential compromise. The team has contained the breach and eradicated the attacker's access. The organization wants to prevent similar incidents in the future. Which action is most aligned with the lessons-learned phase?

   • ARestore the affected user's files from backup.
   • BMonitor the user's account for any further suspicious activity.
   • CImplement multi-factor authentication (MFA) and conduct security awareness training.
   • DDocument the incident timeline and share it with the SOC team.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's incident response plan designates a specific team to handle the initial triage of security alerts. The team is responsible for determining whether an alert is a true positive and, if so, escalating it to the appropriate incident commander. Which phase of the incident response process does this activity primarily support?

   • APreparation
   • BDetection and analysis
   • CRecovery
   • DContainment
   Reveal Solution Discussion Select an answer first