CSC Crisis Management & Incident Response 2

Question 1

During a ransomware attack, which action should be taken FIRST after isolating affected systems?

Accepted Answer

Notify law enforcement and preserve forensic evidence

Answer

Law enforcement notification and evidence preservation are critical first steps before remediation to support investigation and potential prosecution.

Question 2

What is the primary purpose of a tabletop exercise in incident response planning?

Accepted Answer

To walk stakeholders through response procedures in a discussion-based format

Answer

Tabletop exercises are discussion-based simulations where participants walk through response procedures without affecting live systems.

Question 3

Which document formally authorizes an incident response team to take action during a security event?

Accepted Answer

Rules of Engagement (ROE)

Answer

Rules of Engagement define the scope and authority granted to the incident response team during a security event.

Question 4

A company experiences a data breach affecting 50,000 customer records. Under most US state breach notification laws, what is the typical maximum notification window?

Accepted Answer

30–90 days

Answer

Most US state breach notification laws require notifying affected individuals within 30 to 90 days of breach discovery.

Question 5

What is the BEST definition of 'dwell time' in the context of incident response?

Accepted Answer

Time between initial compromise and detection of the breach

Answer

Dwell time measures how long an attacker remains undetected in a network between initial compromise and discovery.

(CSC) Certified Security Consultant Practice Test

(CSC) Certified Security Consultant Practice Test

CSC Crisis Management & Incident Response 2