Align Cybersecurity Incident Response with an Organizations Incident Management, Change Management, and Other ITSM/ITIL Processes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of creating a ticket in the ITSM system when a cybersecurity incident is detected?

   • ATo assign blame to the responsible party for the incident.
   • BTo provide a formal record for tracking, communication, and coordination of the incident response.
   • CTo automatically resolve the incident without human intervention.
   • DTo replace the need for direct communication among incident responders.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of aligning cybersecurity incident response communication with ITSM escalation procedures?

   • ACreating a separate, undocumented communication channel for security incidents only.
   • BCommunicating only with the security team and not with IT service management.
   • CWaiting for the post-incident review to communicate details to stakeholders.
   • DUsing the same severity levels and notification lists as defined in the ITSM incident management process.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   During a ransomware incident, the response team needs to disable a compromised user account and reset credentials for all affected users. The change management policy requires all account changes to be approved. However, the incident is spreading rapidly. What is the best way to handle this while aligning with change management?

   • AUse an emergency change process to disable the account and reset credentials immediately, then document the changes for retrospective approval.
   • BDisable the account and reset credentials without any documentation because it is a security incident.
   • CWait for the change advisory board to approve the changes before taking action.
   • DAsk the IT help desk to make the changes and keep them off the books.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary role of IT incident management in relation to a cybersecurity incident?

   • ATo determine the root cause of the incident and prevent recurrence.
   • BTo decide whether the incident is a security incident or a non-security incident.
   • CTo perform forensic analysis and identify the attacker's methods.
   • DTo coordinate the overall restoration of IT services affected by the incident, including non-security aspects.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security operations center (SOC) analyst detects a potential data breach and needs to escalate it to the incident response team. The organization's ITSM tool has predefined escalation paths. According to the incident management workflow, what should the analyst do to ensure proper escalation?

   • ACall the incident response team lead directly and provide details verbally.
   • BSend an email to the incident response team and wait for them to create a ticket.
   • CCreate a new incident ticket and assign it to the incident response team's queue with a high priority.
   • DUpdate the existing ticket with a note and leave it in the current queue.
   Reveal Solution Discussion Select an answer first