Incident Response Plans

Which of the following is the first step in an incident response plan?

• Containment

• Identification

• Recovery

• Post-incident review

What is the primary goal during the containment phase of incident response?

• To notify the public

• To prevent further damage

• To restore all systems immediately

• To analyse the root cause

Which of the following best describes an indicator of compromise?

• A scheduled software update

• Unusual outbound network traffic

• Regular user login

• Approved software installation

What is the main purpose of a post-incident review?

• To assign blame

• To improve future response

• To delete evidence

• To increase system downtime

Who should be included in the communication plan during a major incident?

• Only the IT team

• All relevant stakeholders

• Only external vendors

• Only customers

Which of the following is NOT a typical containment strategy?

• Disconnecting affected devices from the network

• Isolating compromised accounts

• Ignoring the incident

• Blocking malicious IP addresses

During incident identification, which tool is commonly used to detect unauthorised access?

• Word processor

• Intrusion Detection System (IDS)

• Spreadsheet software

• Printer

What is the first action to take when a ransomware attack is identified?

• Pay the ransom

• Disconnect affected systems from the network

• Inform the media

• Delete all files

Which of the following is a key step in the recovery phase?

• Restoring data from backups

• Ignoring the incident

• Shutting down all systems permanently

• Notifying no one

What should be documented during the incident response process?

• Only successful actions

• All actions taken and observations made

• Only failed attempts

• Nothing