You notice unusual user behavior on your network, such as multiple failed login attempts. What's your first action?

• Eradicate the threat immediately

• Restore normal system operations

• Investigate and classify it as a potential cyber incident

• Skip monitoring and wait for an alert

While investigating a recent cyberattack, you realize the attacker exploited a vulnerability your team was unaware of. What could have been done earlier to reduce this risk?

• Wait for the vulnerability to be exploited before addressing it

• Regular vulnerability assessments and proactive mitigation

• Focus on responding quickly to active threats only

• Avoid making changes to existing systems

Your team is debating which tool is best to monitor unusual user behavior. Which one should you recommend?

• A password manager

• A vulnerability scanner

• A SIEM tool

• A firewall

Imagine you're tracking an ongoing cyber incident. You decide to isolate one server to prevent the attack from spreading. What kind of strategy are you implementing?

• Communication

• Threat elimination

• Isolation as part of damage control

• Restoring operations

A colleague shares an alert about unusual network activity, but it's unclear if it's a cyberattack. What would be your first step to manage this situation?

• Start restoring systems immediately

• Investigate and confirm the nature of the activity

• Notify all stakeholders about a confirmed breach

• Perform a system-wide reboot

During a cybersecurity simulation, you are asked to prioritize tasks. Which action would you perform first if your team identifies an active threat?

• Begin restoring affected systems

• Notify external stakeholders

• Take immediate steps to stop the threat's spread

• Document the incident

A team member suggests completely shutting down all servers during a cyberattack to stop the spread of the threat. What's a potential downside to this approach?

• It disrupts operations unnecessarily

• It accelerates incident containment

• It eradicates the threat completely

• It improves team efficiency

Your manager wants to prevent phishing incidents in the future. What would be the best proactive step to recommend?

• Focus only on system monitoring tools

• Implement stricter access controls for all users

• Conduct company-wide phishing awareness training

• Rely solely on antivirus tools

Your company's system shows signs of a potential data breach. What's the most important reason to classify the severity of the incident?

• To allocate resources based on urgency

• To decide on the recovery timeline

• To immediately notify law enforcement

• To avoid reporting minor incidents

An employee reports their account has been locked due to suspicious login attempts. What should be your team's next step?

• Reset the user's password immediately

• Wait for the user to regain access and report further issues

• Investigate the source of the suspicious activity

• Notify all users about the incident