Develop a Process to Manage, Coordinate, and Communicate Responses to Large-Scale Security Incidents. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During a ransomware incident, the incident response team has confirmed that customer data was exfiltrated. The CEO wants to inform customers immediately, but the legal team advises waiting until the investigation is complete to avoid inaccurate statements. The incident commander must balance transparency with legal risk. Which communication strategy should be adopted?

   • ARemain silent until the investigation is complete and all facts are confirmed.
   • BProvide a preliminary statement to customers acknowledging the incident and stating that an investigation is ongoing, with a commitment to update them.
   • CLet each business unit communicate with its own customers independently to speed up the process.
   • DIssue a detailed statement including all suspected data types and the full timeline of the attack.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is developing an incident response process for large-scale incidents. The company has a small SOC team and relies on external vendors for specialized forensics. The process must ensure that the SOC can coordinate with external vendors while maintaining control over the response. Which process design should be implemented?

   • AKeep external vendors out of the process and rely only on internal resources.
   • BHave the SOC communicate with vendors only through email to maintain a written record.
   • CDefine a clear engagement model for external vendors, including points of contact, communication channels, and approval workflows.
   • DAllow external vendors to take over the response entirely to free up the SOC team.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary goal of an executive summary during an incident?

   • ATo provide a platform for team members to share their opinions
   • BTo document every action taken by the response team
   • CTo provide a detailed technical analysis of the attack
   • DTo convey incident impact, progress, and decisions in a concise format
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large organization is designing its incident response process for large-scale incidents. The SOC is staffed 24/7, but the legal and executive teams are only available during business hours. The organization must ensure that critical decisions can be made at any time without violating legal or regulatory requirements. Which process design should be implemented?

   • ADefine a tiered escalation process that includes an on-call legal advisor and pre-approved decision criteria for common urgent actions.
   • BLimit the incident response process to business hours only, since legal and executives are not available otherwise.
   • CGrant the SOC full authority to make all decisions during off-hours without any legal input.
   • DRequire all decisions to wait until the next business day when legal and executives are available.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A global company is responding to a data breach that affects customers in multiple countries with different data protection regulations. The communication team wants to send a single global message to all affected customers, but legal has advised that notification requirements differ by jurisdiction. The incident commander must develop a communication plan that satisfies all legal obligations while maintaining a consistent brand message. Which approach should be taken?

   • ADelay all customer notifications until a single global legal opinion is obtained.
   • BCreate a core message that is consistent globally, with jurisdiction-specific addenda that address local legal requirements.
   • CSend the same message to all customers, ignoring jurisdictional differences to keep the communication simple.
   • DLet each country's local office handle its own customer communication independently.
   Reveal Solution Discussion Select an answer first