Align Cybersecurity Incident Response with an Organizations Incident Management, Change Management, and Other ITSM/ITIL Processes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security operations center (SOC) is integrating its incident response workflow with the organization's ITSM tool. They want to ensure that security incidents are automatically escalated to the appropriate teams based on severity. What is the best way to achieve this?

   • ACreate a separate ITSM tool instance for security incidents to avoid integration complexity.
   • BConfigure the ITSM tool to automatically assign tickets to the security incident response team based on predefined severity levels and escalation rules.
   • CHave the SOC analyst manually escalate each incident by sending an email to the incident response team.
   • DUse a shared mailbox for all incident escalations and have the incident response team monitor it.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An organization has a high rate of recurring security incidents caused by misconfigured cloud resources. The security team wants to reduce these incidents. Which combination of ITIL processes should they integrate with to address both the immediate incidents and the underlying configuration issues?

   • AService level management for immediate restoration and problem management to fix the root cause.
   • BIncident management for immediate restoration and problem management to identify and fix the root cause.
   • CProblem management for immediate restoration and change management to fix the root cause.
   • DChange management for immediate restoration and incident management to fix the root cause.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An organization is developing a communication plan for cybersecurity incidents. They want to ensure that during a major incident, the CEO, legal counsel, and the IT service desk are informed promptly, but not overwhelmed with unnecessary details. What is the best approach?

   • AUse a single email distribution list for all stakeholders to ensure everyone gets the same information.
   • BDefine different communication templates for each stakeholder group, with appropriate detail levels, and use the ITSM tool to send them based on the incident's severity.
   • CSend the same detailed technical update to all stakeholders, including the CEO and legal counsel.
   • DOnly communicate with the CEO and legal counsel, and let the service desk handle user communication separately.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization is integrating its security incident response with ITIL processes. They want to ensure that security incidents are properly documented and that any changes made during the response are tracked. Which combination of ITIL processes should they integrate with?

   • AChange management for documentation and incident management for tracking changes.
   • BIncident management for documentation and change management for tracking changes.
   • CProblem management for documentation and service level management for tracking changes.
   • DService asset and configuration management for documentation and problem management for tracking changes.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a security incident, the response team needs to block a malicious IP address at the firewall. The organization's change management policy requires all firewall changes to be approved by the change advisory board (CAB). However, the incident is time-sensitive and waiting for the next CAB meeting would delay containment. What is the best approach to align with change management while addressing the urgency?

   • AWait for the next CAB meeting to approve the change before implementing it.
   • BImplement the change immediately and submit a post-incident change request for retrospective approval.
   • CImplement the change without any documentation because it is a security incident.
   • DAsk the firewall administrator to make the change and keep it off the books.
   Reveal Solution Discussion Select an answer first