Which output is a typical result of a post-incident review?

A new incident response plan from scratch

A list of action items to improve incident response

A public statement about the incident

A multinational company is responding to a supply-chain attack that has affected subsidiaries in different time zones. The SOC is in the US, IT teams are in Europe and Asia, and legal is based in the US. The incident commander needs to ensure that all teams are working from the same information and that decisions are made efficiently. Which coordination approach should be used?

Let each regional team manage its own response independently and report back only when the incident is resolved.

Have the SOC work extended hours to cover all time zones and make all decisions centrally.

Establish a single incident command channel with scheduled handoff meetings between regional teams and a shared status board.

Use email as the primary communication channel to ensure a written record of all decisions.

What is the key to effective coordination across multiple teams during a large-scale security incident?

Using a single communication channel for all teams

Clear ownership and defined collaboration points

Having a single team handle all aspects of the incident

Ensuring each team works independently to avoid interference

What is the main objective of a post-incident review?

To identify individuals to discipline for their actions

To determine the financial cost of the incident

To decide whether to report the incident to authorities

To evaluate the effectiveness of the response and identify improvements

What is the primary purpose of a communication plan during a large-scale security incident?

To ensure that all information is shared with all stakeholders

To automate all incident notifications

To document the incident for legal purposes

To define what information is shared, with whom, and through which channels

SplunkCertified Cybersecurity Defense Architect

Domain 3Objective 2

Develop a Process to Manage, Coordinate, and Communicate Responses to Large-Scale Security Incidents. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Part of the Advanced Incident Response and Management domain, which accounts for 10% of the CYBERSECURITY-DEFENSE-ARCHITECT exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

10%of the exam

Questions 6–10

6foundation · easy
Which output is a typical result of a post-incident review?
Select an answer first
7application · medium
A multinational company is responding to a supply-chain attack that has affected subsidiaries in different time zones. The SOC is in the US, IT teams are in Europe and Asia, and legal is based in the US. The incident commander needs to ensure that all teams are working from the same information and that decisions are made efficiently. Which coordination approach should be used?
Select an answer first
8foundation · easy
What is the key to effective coordination across multiple teams during a large-scale security incident?
Select an answer first
9foundation · easy
What is the main objective of a post-incident review?
Select an answer first
10foundation · easy
What is the primary purpose of a communication plan during a large-scale security incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ARCHITECT” is a trademark of its owner, used for identification only.