Align Cybersecurity Incident Response with an Organizations Incident Management, Change Management, and Other ITSM/ITIL Processes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of defining communication paths between cybersecurity incident response and organizational ITSM procedures?

   • ATo ensure that the right stakeholders receive timely and accurate information during an incident.
   • BTo replace the need for a dedicated incident response team.
   • CTo automate the entire incident response process.
   • DTo prevent all information about the incident from being shared externally.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of an emergency change in the context of a cybersecurity incident?

   • ATo implement a necessary security control quickly while still following a defined authorization process.
   • BTo bypass all change management requirements and act without any documentation.
   • CTo replace the incident response plan with a change management plan.
   • DTo permanently alter the security architecture without review.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How should the findings of a post-incident review be incorporated into ITSM processes?

   • ABy storing the review report in a secure location and never referencing it again.
   • BBy automatically deleting the incident ticket to avoid clutter.
   • CBy sharing the review only with the security team and not with IT service management.
   • DBy updating incident response plans, runbooks, and training materials based on the lessons learned.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During a major security incident, the incident commander needs to communicate status updates to executives, the service desk, and affected business units. The organization has an ITSM tool with notification capabilities. What is the best way to ensure consistent and timely communication?

   • AUse the ITSM tool's notification templates to send updates to predefined groups based on the incident's severity.
   • BSend individual emails to each stakeholder with personalized updates.
   • CPost updates on a public website for all employees to see.
   • DRely on the incident commander to call each stakeholder personally.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's IT service desk is receiving multiple reports of a network outage. The security team suspects it might be a distributed denial-of-service (DDoS) attack. How should the security team and the service desk collaborate to handle this situation effectively?

   • AThe service desk closes all tickets and tells users to wait for the security team to resolve the issue.
   • BThe security team creates a separate ticket for the DDoS and does not inform the service desk.
   • CThe security team takes over the incident completely and the service desk stops logging new tickets.
   • DThe security team investigates the potential DDoS while the service desk continues to handle user reports, with both teams updating the same incident ticket.
   Reveal Solution Discussion Select an answer first