Align Cybersecurity Incident Response with an Organizations Incident Management, Change Management, and Other ITSM/ITIL Processes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is handling a phishing incident that has affected multiple users. The organization's ITSM tool has a predefined incident workflow. What should the analyst do to ensure the incident is properly tracked and escalated?

   • ACreate a single incident ticket and link it to all affected users' tickets.
   • BSend an email to the security team and wait for them to create a ticket.
   • CClose all user tickets and create a new ticket for the security team.
   • DCreate a separate ticket for each affected user and handle them independently.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In ITIL, which process is primarily responsible for identifying the underlying cause of recurring cybersecurity incidents?

   • AIncident management
   • BProblem management
   • CChange management
   • DService desk
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which statement best distinguishes cybersecurity incident response from broader IT incident management?

   • ACybersecurity incident response is a subset of IT incident management that only handles network outages.
   • BCybersecurity incident response and IT incident management are identical processes with different names.
   • CCybersecurity incident response focuses on security threats and attacks, while IT incident management addresses any unplanned disruption to IT services.
   • DIT incident management is a subset of cybersecurity incident response that deals with user-reported issues.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After a significant security incident, the incident response team conducts a post-incident review. They identify several areas for improvement in the response process. According to ITIL/ITSM continuous improvement practices, what should the team do with these findings?

   • AClose the incident ticket and consider the process complete.
   • BUpdate the incident response plan and create problem records for underlying issues.
   • CShare the findings only with the security team and keep them confidential.
   • DArchive the findings for future reference without taking action.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In an ITSM incident workflow, what typically triggers an escalation of a cybersecurity incident ticket?

   • AThe incident is automatically escalated when it is first logged.
   • BThe incident exceeds a predefined severity threshold or requires expertise beyond the current support level.
   • CThe incident is escalated only when the user requests it.
   • DThe ticket has been open for more than 24 hours regardless of progress.
   Reveal Solution Discussion Select an answer first