CISM Domain 4 Exam

During the preparation phase of incident response, which of the following is the best approach for managing critical data backups?

• Daily backups to a local device

• Weekly backups to an offsite location

• Monthly backups to a cloud-based storage system

• Hourly backups to a redundant, offsite location

Answer explanation

Hourly backups to a redundant, offsite location. This is the best approach for managing critical data backups during the preparation phase, as it ensures that the most up-to-date data is available in the event of an incident. The other options are not ideal, as daily, weekly, and monthly backups do not provide sufficient frequency of backups, and storing backups in a single location (whether local or offsite) can create a single point of failure.

During the identification phase of incident response, which of the following is the best approach for detecting a potential incident?

• Using intrusion detection software

• Regularly reviewing logs and system events

• Conducting vulnerability scans

• Monitoring employee emails

Answer explanation

Using intrusion detection software. This is the best approach for detecting a potential incident during the identification phase, as it can detect suspicious activity and alert security personnel to investigate further. The other options are not as effective, as reviewing logs and system events, conducting vulnerability scans, and monitoring employee emails are all reactive measures that may not detect incidents until after they have occurred.

During the investigation phase of incident response, which of the following is the best approach for determining the scope and impact of the incident?

• Interviewing witnesses and affected parties

• Examining system logs and other evidence

• Conducting vulnerability scans

• Restoring systems to a previous state

Answer explanation

Examining system logs and other evidence. This is the best approach for determining the scope and impact of the incident during the investigation phase, as it can help identify the root cause of the incident and determine what systems or data were affected. Interviewing witnesses and affected parties can also be helpful, but it is not as effective as examining system logs and other evidence. Conducting vulnerability scans and restoring systems to a previous state are not effective during the investigation phase, as they are reactive measures that may not provide a full understanding of the incident.

During the recovery phase of incident response, which of the following is the best approach for restoring systems to normal operation?

• Installing software patches and updates

• Restoring from a recent backup

• Reformatting affected systems

• Resetting all user passwords

Answer explanation

Restoring from a recent backup. This is the best approach for restoring systems to normal operation during the recovery phase, as it can ensure that the systems are restored to a known good state. Installing software patches and updates is also important, but it is not sufficient on its own. Reformatting affected systems and resetting all user passwords are not necessary during the recovery phase, and may cause additional downtime and disruption.

John, a security analyst, has identified a potential security incident. Which stage of the NIST Incident Response Framework should he proceed to?

• Preparation

• Detection and Analysis

• Containment, Eradication, and Recovery

• Post-Incident Activity

Answer explanation

Detection and Analysis. In this stage, the incident is identified, categorized, and prioritized based on the initial analysis.

The other options aren't correct. Preparation is the stage where an organization prepares for potential security incidents by developing incident response plans, identifying key personnel, and implementing security controls. Containment, Eradication, and Recovery involve isolating the affected systems, removing the malware or attacker, and restoring normal operations. Post-Incident Activity involves documenting the incident, analyzing the response, and developing a plan to prevent similar incidents in the future.

After detecting and analyzing an incident, what is the next step in the NIST Incident Response Framework?

• Preparation

• Detection and Analysis

• Containment, Eradication, and Recovery

• Post-Incident Activity

Answer explanation

Once an incident has been identified and analyzed, the next step is to contain the incident, eradicate the malware or attacker, and recover any affected systems. The goal of this stage is to restore normal operations as quickly as possible while minimizing damage.

After an incident has been contained, what is the next step in the NIST Incident Response Framework?

• Preparation

• Detection and Analysis

• Containment, Eradication, and Recovery

• Post-Incident Activity

Answer explanation

Containment, Eradication, and Recovery.

After an incident has been contained, the focus shifts to eradicating the malware or attacker and recovering any affected systems. The goal of this stage is to restore normal operations as quickly as possible while minimizing damage.

What is the final step in the NIST Incident Response Framework?

• Preparation

• Detection and Analysis

• Containment, Eradication, and Recovery

• Post-Incident Activity

Answer explanation

Post-Incident Activity.

After the incident has been contained, eradicated, and recovered from, the final step is to document the incident, analyze the response, and develop a plan to prevent similar incidents in the future.

Jane, the security analyst, is responsible for preparing the organization's incident response plan. Which of the following is NOT an essential element of incident response planning?

• Defining roles and responsibilities

• Establishing communication procedures

• Documenting and reporting incidents

• Reacting to the incident as quickly as possible

Answer explanation

Reacting to the incident as quickly as possible is incorrect because reacting to the incident as quickly as possible is not an element of incident response planning. While incident response plans should aim to respond quickly, they also need to be well thought out and strategic to minimize the impact of the incident.

After detecting a security incident, Tom, the Incident Response Manager, analyzes the incident to determine the scope and severity of the incident. Which of the following is the BEST approach for incident analysis?

• Quickly contain the incident and then begin analysis

• Notify all stakeholders and wait for their input

• Begin analysis immediately and contain the incident simultaneously

• Conduct analysis after the incident is fully resolved

Answer explanation

is correct because it is important to begin incident analysis immediately while simultaneously containing the incident to minimize the impact of the incident.

Quickly contain the incident and then begin analysis is incorrect because containment should be done simultaneously with analysis. Notify all stakeholders and wait for their input is incorrect because it could delay the analysis process, and Conduct analysis after the incident is fully resolved is incorrect because analysis should not wait until after the incident is fully resolved.