Develop a Process to Manage, Coordinate, and Communicate Responses to Large-Scale Security Incidents. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations center is managing a prolonged incident that has lasted several weeks. The incident commander must provide weekly status updates to the executive team. The executives have expressed frustration that the updates are too technical and do not clearly state what decisions they need to make. Which change should the incident commander make to the status updates?

   • AInclude a summary of the current impact, key milestones achieved, and a list of decisions requiring executive input.
   • BProvide a detailed technical breakdown of the attack vectors and the tools used to contain them.
   • CReduce the frequency of updates to once a month to avoid overwhelming the executives with information.
   • DSend the full incident timeline and all documentation to the executives for their review.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a major incident, the incident response team conducts a post-incident review. The review reveals that the escalation path was unclear, causing a two-hour delay in involving the legal team. The team wants to prevent this in future incidents. Which action should be taken as a result of the review?

   • AUpdate the incident response plan to include specific triggers and timeframes for escalating to legal and other stakeholders.
   • BDocument the delay in the incident report but take no further action.
   • CAdd legal as a permanent member of the SOC team to ensure they are always available.
   • DConduct a training session for the SOC team on how to use the existing escalation procedures.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which factor is most important when deciding what information to share with external stakeholders during an incident?

   • AThe potential impact on the organization's reputation
   • BThe technical complexity of the incident
   • CThe personal preferences of the incident commander
   • DThe legal and regulatory requirements for disclosure
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of maintaining incident documentation?

   • ATo create a marketing report for customers
   • BTo assign blame to team members who made mistakes
   • CTo provide a record of the incident for legal and regulatory compliance
   • DTo replace the need for post-incident reviews
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which element should be included in a regular status update to stakeholders?

   • AThe current status of the incident and next steps
   • BThe exact commands used by the attackers
   • CThe names of all team members involved
   • DThe personal opinions of the incident commander
   Reveal Solution Discussion Select an answer first