Incident Response

The main purpose of a hot site in disaster recovery is to:

• Provide a secure location for storing sensitive data.
• Offer a temporary workspace for displaced employees.
• Enable a rapid switch-over to a fully operational backup environment.
• Facilitate communication with stakeholders during a crisis.

The "Identify" function in the NIST framework involves understanding:

• The best methods for data encryption.
• The types of antivirus software available.
• Your organization's critical assets and vulnerabilities.
• The latest cyberattack trends worldwide.

Which of the following is an example of an incident containment strategy?

• Installing new hardware
• Blocking malicious IP addresses
• Updating user passwords regularly
• Conducting a security awareness program

During which phase are lessons learned documented and analyzed?

• Preparation
• Detection and Analysis
• Containment, Eradication, and Recovery
• Post-Incident Activity

A tool like Splunk is primarily used for:

• Vulnerability scanning
• Security information and event management
• Endpoint detection
• Malware analysis

Which phase of incident response includes conducting regular training and awareness programs for employees?

• Preparation
• Detection and Analysis
• Containment, Eradication, and Recovery
• Post-Incident Activity

In the context of incident response, what is the purpose of conducting a Business Impact Analysis (BIA)?

• To detect security incidents
• To establish communication channels
• To understand the impact of disruptions on business functions
• To automate incident response tasks

What is the main function of a SIEM system?

• To provide endpoint detection and response capabilities
• To collect and analyze security event data
• To automate incident response tasks
• To aggregate threat intelligence data

Which of the following is considered an indicator of compromise?

• Regularly scheduled backup
• Unusual outbound network traffic
• Software update notification
• System reboot

Unauthorized login attempts are an indicator of what type of security incident?

• Data exfiltration
• Phishing attack
• Brute-force attack
• Denial-of-service attack