Develop a Process to Manage, Coordinate, and Communicate Responses to Large-Scale Security Incidents. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   During a large-scale incident, the incident response team is documenting actions in real time. However, the documentation is incomplete because some team members are too busy to log their actions immediately. The incident commander needs a complete and accurate record for the post-incident review. Which strategy should be implemented to ensure documentation is not neglected?

   • ARely on automated tools to capture all actions without any human input.
   • BAssign a dedicated documentation officer who is responsible for capturing actions and maintaining the incident timeline.
   • CRequire all team members to log their actions at the end of their shift, regardless of how much time has passed.
   • DDocument only the final outcome of the incident and skip the detailed timeline.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A post-incident review is being conducted after a major security incident. The review team includes members from the SOC, IT, legal, and executive stakeholders. The SOC believes the incident was handled well, but IT argues that the response was too aggressive and disrupted business operations. The incident commander must facilitate a review that leads to meaningful improvements. Which approach should be taken?

   • ASide with the SOC since they are the security experts and their actions were technically correct.
   • BEncourage open discussion of all perspectives, focusing on systemic issues rather than individual blame.
   • CLimit the review to technical findings and exclude business impact discussions to avoid conflict.
   • DConclude the review quickly to avoid tension and move on to the next incident.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which component is essential in a structured incident response process for large-scale security incidents?

   • AA public status page for external customers
   • BDefined roles and escalation paths
   • CAutomated containment for all incident types
   • DA single point of contact for all communication
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A large financial services firm has just activated its incident response plan for a suspected ransomware outbreak affecting multiple business units. The SOC lead has been designated as the incident commander, but the legal team is demanding direct control over all external communications, and the IT director insists on approving every containment action. The response is stalling because team members are receiving conflicting instructions. Which action should the incident commander take first to restore momentum?

   • APause all response activities until the stakeholders agree on a new decision-making framework.
   • BAllow legal to take over external communications while IT approves containment actions, to satisfy both parties.
   • CReaffirm the incident command structure and clarify that the SOC lead retains tactical authority while legal and IT retain advisory roles.
   • DEscalate the dispute to the executive team and request a formal ruling on who has final authority during the incident.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   During a large-scale incident, the incident commander is coordinating the response across the SOC, IT, legal, and executive teams. The SOC is focused on containment, IT is concerned about business continuity, and legal is worried about regulatory compliance. The incident commander must ensure that all teams work together effectively. Which coordination strategy should be used?

   • ALet each team pursue its own priorities independently and report back to the incident commander.
   • BPrioritize the SOC's actions above all others since they are the security experts.
   • CEstablish a joint command structure with representatives from each team and a shared decision-making process.
   • DHave the incident commander make all decisions without consulting the teams to speed up the response.
   Reveal Solution Discussion Select an answer first