Which term refers to the ability to absorb, adapt, and recover from disruptions while maintaining essential operations?

In the Incident Management Lifecycle, which phase involves assigning severity and urgency to incidents?

What is the main objective of the “Post-Incident Review” (PIR)?

Which of these is a key metric for measuring resilience in incident management?

In the context of First Response, who is typically the first responder in a bank’s IT environment?

Which of the following is a “Do” for a first responder?

Which of the following is a “Don’t” for a first responder?

In incident detection, which tool category provides centralized visibility of security events?

Which statement best describes the relationship between Incident Management and Incident Response?

During an incident, the SOC receives alerts from multiple systems showing unusual outbound traffic. The first responder isolates the affected segment but fails to capture volatile memory before shutdown. Which aspect of resilience was most impacted?

In a high-severity incident, a banking core application goes down. The incident management team is following the lifecycle process. At which point should they engage the Post-Incident Review (PIR) process?

The bank’s incident log shows several critical incidents being escalated late because SOC analysts waited for “full confirmation.” Which resilience principle is being violated?

During a ransomware attack, the bank’s DRP (Disaster Recovery Plan) is invoked. The recovery site is operational within the RTO, but some customer transaction logs are missing. Which metric was likely not met?

In incident management, why might automating certain first response tasks (e.g., isolating infected endpoints via SOAR) actually improve resilience?

A phishing email compromises a senior bank executive’s credentials. The first responder follows the playbook and resets the account but fails to notify compliance within the CBN’s stipulated window. Which risk is now introduced?

The SOC team detects abnormal fund transfer patterns at 2:00 AM. Logs indicate the issue started at 1:40 AM, but the alert system only triggered at 1:59 AM. Which control improvement would most directly reduce the impact of this type of incident?

During an incident, the IT operations team restores service without informing the forensics team, who were still gathering evidence. Which resilience factor has been undermined?

While handling a DDoS attack, the incident manager prioritizes service restoration for the bank’s public website but delays internal system recovery. This decision aligns with which resilience principle?

A critical incident occurs in the bank’s core payment switch. The team follows escalation protocols, but the delay in resolving the issue is traced to outdated contact information for the vendor in the incident response plan. Which aspect of resilience planning failed?