Align Cybersecurity Incident Response with an Organizations Incident Management, Change Management, and Other ITSM/ITIL Processes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security incident required a temporary firewall rule change to block malicious traffic. After the incident, the change was not documented, and the rule remained in place. What should the organization do to align with change management and prevent this in the future?

   • ARemove the rule immediately without documentation.
   • BCreate a change request to document the temporary rule and schedule its removal, and update the incident response plan to require documentation of all changes.
   • CLeave the rule in place and do not document it because it was part of the incident response.
   • DBlame the incident responder for not documenting the change.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst detects a suspected ransomware infection on a single workstation. The organization's IT service desk uses an ITSM tool for all incident tickets. The security team has its own incident response playbook. According to the principle of aligning cybersecurity incident response with broader IT incident management, what should the analyst do first?

   • AOpen a security incident ticket in the ITSM tool and link it to the existing service desk ticket for the workstation.
   • BIsolate the workstation and handle the response entirely within the security team's playbook, without creating an ITSM ticket.
   • CClose the existing service desk ticket and create a new 'security incident' ticket type in the ITSM tool.
   • DEscalate the issue directly to the IT manager and wait for instructions before taking any action.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is it important to document cybersecurity incident response actions as changes in the change management system?

   • ATo ensure that all modifications to the environment are authorized, traceable, and reversible.
   • BTo transfer ownership of the incident to the change management team.
   • CTo automatically resolve the incident without further investigation.
   • DTo prevent the incident from being classified as a security incident.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security operations center (SOC) is reviewing its incident response procedures. They notice that cybersecurity incidents are often handled by the IT service desk first, causing delays in escalation to the security team. What is the best way to align cybersecurity incident response with IT incident management to reduce these delays?

   • AEliminate the service desk and have all incidents go directly to the SOC.
   • BImplement a triage process in the service desk that identifies potential security incidents and escalates them to the SOC immediately.
   • CRequire the service desk to handle all incidents, including security ones, until resolution.
   • DCreate a separate service desk for security incidents to avoid delays.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security incident requires a critical firewall rule change to contain the threat. The change management policy requires all changes to be approved by the change advisory board (CAB). However, the next CAB meeting is in two days. What is the most appropriate action to align with change management while ensuring timely containment?

   • AImplement the change without any documentation because it is a security incident.
   • BSubmit an emergency change request and implement the change immediately, then document it for retrospective approval.
   • CAsk the firewall administrator to make the change and keep it off the books.
   • DWait for the CAB meeting to approve the change before implementing it.
   Reveal Solution Discussion Select an answer first