Topic 12A: Incident Response

What is the primary purpose of the incident response team's preparation phase?

• To identify the root cause of security breaches

• To recover data from backup systems

• To make the system resilient to attack

• To analyze incident response effectiveness

Which phase of the incident response lifecycle focuses on limiting the immediate impact of an incident on customers and business partners?

• Detection

• Analysis

• Containment

• Eradication

What is the objective of the eradication phase in incident response?

• To recover data from backup systems

• To remove the cause of the incident and restore affected systems

• To contain the incident and prevent further damage

• To analyze incident response procedures

Which team member typically leads the incident response team and can authorize actions following serious incidents?

• Analyst

• Technician

• Senior executive decision-maker

• Human Resources manager

What is the primary role of legal advisors in incident response?

• Assessing compliance with laws and regulations

• Restoring affected systems to a secure state

• Managing negative press and social media reactions

• Performing data forensics analysis

Why is it essential to establish clear lines of communication during incident response?

• To share incident details with the public

• To alert threat actors about containment measures

• To notify affected parties and stakeholders

• To provide access to confidential information

Which phase of incident response involves developing profiles or scenarios of typical incidents?

• Preparation

• Detection

• Containment

• Lessons learned

What is the primary goal of threat hunting in incident response?

• To reactively respond to security alerts

• To proactively discover evidence of threat activity

• To recover data from compromised systems

• To analyze incident response effectiveness

How can isolation-based containment be implemented in incident response?

• By removing an affected component from its larger environment

• By segmenting the network using VLANs and firewalls

• By reconfiguring system permissions and access controls

• By monitoring network traffic for suspicious activity

What is a critical consideration when selecting containment techniques during incident response?

• Minimizing costs and resource requirements

• Ensuring rapid recovery of affected systems

• Avoiding detection by threat actors

• Preventing unauthorized access to incident data