Cyber Incident Response Quiz

What is the first phase of incident response?

• Identification

• Recovery

• Containment

• Preparation

What is the main focus of most organizations during incident response?

• Eradication

• Containment

• Lessons learned

• Preparation

What is the purpose of the identification phase in incident response?

• To review forensic images

• To clear up the awareness of the incident

• To test the fixes in the eradication phase

• To restore systems from backup

What should be done during the containment phase of incident response?

• Isolate compromised accounts

• Test functionality

• Review log files

• Restore systems from backup

What is the main goal of the eradication phase in incident response?

• Restoring systems from backup

• Testing the fixes in the recovery phase

• Isolating compromised accounts

• Removing and remediating any damage

Why is it important to have a lessons learned phase in incident response?

• To prevent future incidents

• To lock down compromised accounts

• To review log files

• To identify the source of the compromise

What is the best way to improve cybersecurity standing after an incident?

• Reviewing what went wrong and using the incident as a stepping stone to work towards a solution

• Rushing to get back up and running

• Skipping the lessons learned phase

• Reviewing log files

Who should perform incident response?

• Persons trained and equipped for it

• Third-party contractors

• Any employee in the organization

• Customers of the organization

What is becoming more common for a full response to be required before settlement can be made?

• Human error

• Log file analysis

• Incident prevention

• Cyber insurance

What should you do if you suspect you may be compromised?

• Contact the authorities

• Contact inProgressive for help

• Ignore the suspicion

• Delete and restore systems immediately