INCIDENCE RESPONSE PROCESS: What is the first step in the incident response process?

• Preparation

• Identification

• Containment

• Eradication

A company detects unusual outbound network traffic that could indicate data exfiltration. What should be done next?

• Identify and confirm the incident by analyzing logs and alerts.

• Ignore the traffic as it might be a false alarm.

• Immediately shut down all network operations.

• Contact the internet service provider to block the traffic.

Employees report receiving emails from a compromised internal account requesting sensitive data. What should be done next?

• Yes, because it indicates a potential account takeover and requires immediate containment.

• No, because it might be a false alarm and can be ignored.

• Yes, because it is a common occurrence and does not require immediate action.

• No, because it is not related to cybersecurity threats.

INCIDENCE RESPONSE PROCESS Scenario: A ransomware infection has locked multiple workstations. The IT team is unsure whether to shut down affected systems. What should they do?

• Shut down the affected systems immediately.

• Disconnect the affected systems from the network.

• Wait for instructions from higher authorities.

• Attempt to decrypt the files themselves.

Scenario: A malware outbreak spreads across the network. What actions should be taken?

• Isolate affected systems and update antivirus software.

• Ignore the outbreak and continue normal operations.

• Unplug all network cables immediately.

• Contact the media to report the outbreak.

INCIDENCE RESPONSE PROCESS Containment and Mitigation Scenario: A phishing attack compromised employee credentials. The attacker is attempting to access sensitive data. What should be done?

• Notify the IT department and change all passwords immediately.

• Ignore the attack and continue working.

• Share credentials with the attacker to monitor their actions.

• Wait for the attacker to make the next move.

Scenario: The IT team detects unauthorized administrative access on a critical server. What steps should be taken?

• Investigate the source of access and revoke permissions

• Ignore the access as it might be a false alarm

• Immediately shut down the server

• Notify all users about the breach

After a successful incident containment, what should be done next?

• Reimage infected systems and update security patches to prevent reinfection.

• Document the incident and lessons learned.

• Ignore the incident and move on.

• Notify the media about the incident.

A cyberattack exploited a known vulnerability. What steps should be taken?

• Patch the vulnerability, enhance monitoring, and update access controls.

• Ignore the vulnerability and hope it doesn't happen again.

• Only update access controls without patching.

• Enhance monitoring but leave the vulnerability unpatched.

Handling Critical Escalations: A data breach affecting customer records is confirmed. What actions should be taken?

• Notify affected customers and authorities immediately.

• Ignore the breach and continue operations.

• Delete all customer records to prevent further issues.

• Wait for further instructions from management.