2.2 Explain the Concept of Incident Management and Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In an incident response team, which role is responsible for making final decisions and coordinating the overall response effort during a major incident?

   • AIT Support Technician
   • BIncident Commander
   • CStakeholder
   • DSecurity Analyst
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How are incidents typically classified to guide response efforts?

   • ABy the attacker's motivation
   • BBy the cost of the response
   • CBy the number of users affected
   • DBy type, severity, and impact
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A security operations center receives two alerts: one for a low-severity malware detection on a single workstation, and another for a potential data breach involving a database with customer information. The SOC has limited resources and can only respond to one incident at a time. Which incident should be prioritized?

   • ABoth incidents equally because both are security incidents
   • BThe malware detection because it is a confirmed infection
   • CThe data breach because it involves sensitive customer data and has higher potential impact
   • DThe malware detection because it was detected first
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the incident management lifecycle, which phase occurs first and involves establishing policies, tools, and training before an incident happens?

   • ADetection
   • BContainment
   • CPreparation
   • DAnalysis
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary goal of incident triage?

   • ATo eradicate the threat
   • BTo identify the root cause
   • CTo validate whether an incident is real and determine its scope
   • DTo immediately contain the incident
   Reveal Solution Discussion Select an answer first