csa module 6-1

Which of the following best defines Incident Response?

• The process of preventing all cyber incidents from happening

• A documented approach for handling and managing security breaches

• Regular software updates to prevent malware

• The automatic blocking of malicious IP addresses

Which of the following is NOT a typical member of an Incident Response Team (IRT)?

• Incident Handler

• Forensic Analyst

• Malware Analyst

• Company Janitor

In most organizations, the IRT reports to which department?

• Facilities Management

• Human Resources

• Information Security or IT Security Department

• Customer Support

Which of these is a key responsibility of the IRT during the “Containment” phase?

• Collecting evidence from affected systems

• Notifying law enforcement about all incidents

• Disconnecting all servers from the internet permanently

• Designing the company’s annual training program

The IRT plays a crucial role in __________.

• Long-term policy development only

• Real-time decision-making during active security incidents

• Designing office interiors

• Selling security products

If an IRT is placed too low in the organizational hierarchy, what is a potential risk?

• They may have too much power over executives

• They may lack authority to take quick and necessary actions

• They will always overestimate threats

• They will focus only on physical security

Which of the following best describes a Computer Security Incident Response Team (CSIRT)?

• A team dedicated to building secure applications

• A team that responds to and manages IT security incidents

• A group of penetration testers

• A set of automated security tools

Why is it important for the IRT to be integrated with legal and HR departments?

• To handle budget approvals for new hardware

• To ensure compliance, handle insider threats, and manage employee-related incidents

• To improve website design

• To train employees in programming

In a typical organization, what is the SOC’s main role in relation to the IRT?

• Perform legal review of security incidents

• Detect and monitor suspicious activities, then escalate to the IRT when needed

• Approve funding for IR processes

• Handle physical security breaches

Which of the following is the FIRST step in the Incident Response process?

• Containment

• Eradication

• Preparation

• Recovery