Develop a Process to Manage, Coordinate, and Communicate Responses to Large-Scale Security Incidents. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of defining escalation paths in an incident response process?

   • ATo document the incident for post-incident review
   • BTo automatically notify all employees of an incident
   • CTo ensure that incidents are resolved by the most senior staff
   • DTo provide a clear route for raising issues that require higher-level decision-making
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An incident commander is preparing the final executive summary after a major incident has been resolved. The summary will be used to justify additional security investments to the board. The incident commander has access to the incident timeline, cost estimates, and lessons learned. Which information should be included to make the strongest case for additional investment?

   • AQuantify the financial impact of the incident and highlight specific gaps in the security posture that led to the incident.
   • BInclude only the cost of the incident and omit any recommendations to avoid seeming self-serving.
   • CProvide a detailed technical account of the attack and the tools used to respond.
   • DEmphasize that the response team performed well and no changes are needed.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An incident commander is preparing an executive summary for the board of directors after a significant security incident. The board is concerned about the financial impact and the company's reputation. The incident commander has access to detailed technical reports and the incident timeline. Which approach should be used to create the executive summary?

   • ASummarize the incident's business impact, key decisions made, and the current status, using non-technical language.
   • BFocus only on the financial impact and omit details about the response to avoid alarming the board.
   • CInclude the full technical timeline and all evidence collected to provide complete transparency.
   • DProvide a verbal update to the board and avoid written documentation to prevent leaks.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A healthcare organization is responding to a data breach that may involve protected health information. The incident response team has confirmed the breach and is preparing to notify affected patients, but the legal department has not yet completed its regulatory assessment. The CEO wants to send an immediate press release to reassure the public. Which communication action should the team take first?

   • ACoordinate with legal to align the press release with regulatory requirements and finalize the notification timeline.
   • BSend the press release only to internal stakeholders and wait for legal approval before any external communication.
   • CIssue the press release immediately to maintain public trust, then adjust details as the investigation progresses.
   • DDelay all communication until the full investigation is complete and all facts are known.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An incident response team is documenting a large-scale incident that involved multiple waves of phishing attacks. The team has been using a shared document to record actions, but the document has become disorganized with duplicate entries and unclear statuses. The incident commander needs a clear picture of what has been done and what remains. Which documentation approach should the team implement?

   • AAdopt a structured incident log with predefined fields for action, owner, status, timestamp, and related evidence.
   • BKeep the shared document but add a rule that only the incident commander can make entries.
   • CAssign one person to rewrite the entire document from scratch at the end of each day.
   • DUse a separate document for each wave of the attack to avoid mixing information.
   Reveal Solution Discussion Select an answer first