2.2 Explain the Concept of Incident Management and Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which activity is typically part of the lessons learned phase?

   • ADeleting malware from infected hosts
   • BIsolating affected systems
   • CRestoring data from backups
   • DDocumenting findings and updating incident response plans
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations center receives two simultaneous alerts: (1) a single workstation with a known malware signature, and (2) multiple servers showing signs of data exfiltration to an external IP. The SOC manager must prioritize response efforts. Which approach best aligns with incident classification and prioritization principles?

   • AIgnore the workstation alert because it is a known signature
   • BInvestigate the workstation alert first because it was detected first
   • CTreat both alerts as equal priority and investigate them in parallel
   • DInvestigate the server exfiltration first because it affects multiple systems and indicates data loss
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   An organization has a security operations center that monitors alerts 24/7. A user reports a suspicious email to the help desk, but the help desk does not have a formal process for escalating security incidents. The email is later found to be a phishing attempt that compromised several accounts. What is the most significant gap in the incident management process?

   • ALack of incident response team members
   • BLack of advanced security tools
   • CLack of user awareness training
   • DLack of a formal incident reporting and escalation process
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is clear communication important during incident response?

   • AIt prevents the incident from occurring
   • BIt speeds up the eradication process
   • CIt eliminates the need for documentation
   • DIt ensures all team members understand their roles and the current status
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   During triage, what is the first step an analyst should take when a new alert is received?

   • AEradicate the threat
   • BValidate the alert to confirm it is a real incident
   • CContain the affected systems immediately
   • DNotify external parties
   Reveal Solution Discussion Select an answer first