CSC - Cybersecurity Compliance Incident Response and Reporting Questions and Answers 1 — Questions and Answers
Question 1: A financial services firm discovers a sophisticated malware infection on a server processing customer data. According to the NIST SP 800-61 incident response lifecycle, which of the following is a primary objective of the 'Containment, Eradication, and Recovery' phase?
- Conducting a post-incident review to document lessons learned.
- Developing an incident response policy and training the response team.
- Isolating the affected server from the network to prevent the malware from spreading. (Correct answer)
- Analyzing network traffic logs to determine the initial attack vector.
Correct answer: Isolating the affected server from the network to prevent the malware from spreading.
The 'Containment, Eradication, and Recovery' phase focuses on limiting the scope and impact of the incident. Isolating the affected server is a key containment strategy to stop the threat from spreading to other systems. Analyzing logs is part of 'Detection and Analysis', policy development is 'Preparation', and the post-incident review is 'Post-Incident Activity'.
Question 2: A European e-commerce company becomes aware of a personal data breach. Under the General Data Protection Regulation (GDPR), what is the maximum timeframe within which the company must notify the relevant supervisory authority, unless the breach is unlikely to result in a risk to individuals' rights and freedoms?
- Within 24 hours of discovery
- Without undue delay, but no later than 60 days
- Within 72 hours of becoming aware of the breach (Correct answer)
- Within 30 days of containing the breach
Correct answer: Within 72 hours of becoming aware of the breach
Article 33 of the GDPR explicitly states that a data controller must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it.
Question 3: Which of the following activities is MOST characteristic of the 'Post-Incident Activity' phase of the NIST incident response lifecycle?
- Disconnecting an infected workstation from the corporate network.
- Identifying and prioritizing critical IT assets and systems.
- Analyzing security tool alerts to confirm a suspected incident.
- Updating the incident response plan based on lessons learned from a recent breach. (Correct answer)
Correct answer: Updating the incident response plan based on lessons learned from a recent breach.
The 'Post-Incident Activity' phase is focused on learning from the incident to improve future responses and the organization's overall security posture. A key activity is holding a lessons-learned meeting and using the findings to update policies, procedures, and controls.
Question 4: A U.S.-based energy company, defined as critical infrastructure, suffers a major cyberattack that disrupts operations. They pay a ransom to the attackers. According to the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), to which federal agency must they report the ransomware payment?
- The Federal Bureau of Investigation (FBI)
- The National Security Agency (NSA)
- The Department of Homeland Security (DHS)
- The Cybersecurity and Infrastructure Security Agency (CISA) (Correct answer)
Correct answer: The Cybersecurity and Infrastructure Security Agency (CISA)
The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) mandates that covered entities report covered cyber incidents and ransomware payments directly to the Cybersecurity and Infrastructure Security Agency (CISA).
Question 5: A business associate of a healthcare provider discovers that a misconfigured server has exposed the protected health information (PHI) of 300 patients. Under the HIPAA Breach Notification Rule, what is the business associate's primary and most immediate reporting obligation?
- Notify the Department of Health and Human Services (HHS) within 72 hours.
- Post a notice on their company website for 90 days.
- Notify the covered entity (the healthcare provider) without unreasonable delay. (Correct answer)
- Send individual notification letters to all 300 affected patients.
Correct answer: Notify the covered entity (the healthcare provider) without unreasonable delay.
The HIPAA Breach Notification Rule requires a business associate to notify the covered entity after discovering a breach 'without unreasonable delay and in no case later than 60 days' following discovery. The covered entity is ultimately responsible for notifying affected individuals and HHS.
Question 6: An incident response team is handling a data breach. The team leader emphasizes the importance of documenting every action taken, preserving system logs, and creating forensic images of affected hard drives. This meticulous process is most critical for which of the following outcomes?
- Ensuring compliance with media notification requirements.
- Calculating the mean time to recovery (MTTR) for performance metrics.
- Facilitating potential legal action and supporting law enforcement investigations. (Correct answer)
- Immediately restoring business operations to minimize downtime.
Correct answer: Facilitating potential legal action and supporting law enforcement investigations.
While documentation is important for all aspects of incident response, the rigorous preservation of evidence (chain of custody, forensic images, detailed logs) is specifically crucial for supporting any future legal proceedings, regulatory investigations, or law enforcement activities. This ensures the evidence is admissible and can be used to build a case.
CSC - Cybersecurity Compliance Incident Response and Reporting Questions and Answers 1
A financial services firm discovers a sophisticated malware infection on a server processing customer data.
According to the NIST SP 800-61 incident response lifecycle, which of the following is a primary objective of the 'Containment, Eradication, and Recovery' phase?