Develop a Process to Manage, Coordinate, and Communicate Responses to Large-Scale Security Incidents. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is documenting a large-scale incident. The analyst has been recording actions in a shared spreadsheet, but several entries are missing timestamps and some actions were performed by multiple team members without clear attribution. The incident commander needs an accurate timeline for the post-incident review. Which documentation practice should the analyst adopt?

   • ARecord only the major actions taken, omitting minor details to reduce the documentation burden.
   • BContinue using the spreadsheet but ask team members to fill in missing timestamps from memory at the end of the day.
   • CUse a centralized incident tracking tool that enforces timestamps, assigns ownership to each action, and provides an audit trail.
   • DWait until the incident is over and then reconstruct the timeline from emails and chat logs.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After containing a significant phishing campaign that compromised several user accounts, the incident response team is conducting a post-incident review. The team identifies that the detection rule failed to trigger because it relied on a single indicator that was easily bypassed. Which outcome should the review produce?

   • AA summary of the incident that is shared only with the SOC team, without any follow-up actions.
   • BA set of actionable improvements, such as updating detection rules to use multiple indicators and adding user training on phishing awareness.
   • CA decision to discontinue using email security tools because they are ineffective.
   • DA formal reprimand for the analyst who created the ineffective detection rule.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which practice best supports collaboration between the SOC and legal teams during an incident?

   • ASharing all technical details with legal in real time
   • BKeeping legal out of the incident until it is resolved
   • CHaving legal make all technical decisions
   • DEstablishing a liaison to translate technical findings for legal
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is responding to a security incident that has attracted media attention. The CEO wants to provide regular public updates, but the legal team is concerned about revealing sensitive information that could be used against the company. The incident commander must develop a communication plan that satisfies the CEO's desire for transparency while protecting the company's legal position. Which communication approach should be adopted?

   • AProvide no public updates until the incident is fully resolved to avoid any legal risk.
   • BDesignate a single spokesperson who delivers pre-approved messages that balance transparency with legal considerations.
   • CAllow the CEO to speak freely to the media to demonstrate transparency.
   • DHave each team member provide updates to the media from their own perspective.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following should be included in incident documentation?

   • AA list of all software licenses owned by the company
   • BA timeline of events and actions taken
   • CThe personal contact information of all employees
   • DThe company's marketing strategy
   Reveal Solution Discussion Select an answer first